CVE-2026-89054

Name of the Vulnerable Software and Affected Versions OpenNMS Horizon versions prior to 36.0.4

Description A missing authorization issue allows unauthenticated configuration changes. The Spring Security policy for the '/api/v2' REST API fails to define authorization rules for the PATCH HTTP method. Consequently, configuration endpoints for event configuration and SNMP data collection are accessible without authentication. An attacker with access to the web UI can disable event definitions and SNMP data collection, which suppresses alarm generation and stops metric collection, leading to a silent degradation of monitoring and detection capabilities.

Recommendations Upgrade to version 36.0.4 or newer. Ensure the software is installed within a private network and not directly accessible from the Internet.