Is CVE-2026-127236 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-127236 being exploited in the wild.

How severe is CVE-2026-127236?

Medium severity, with a CVSS score of 5.4, published 12 November 2026.

Which products and versions are affected?

OpenNMS Horizon before 36.0.6; OpenNMS Meridian before 2024.3.15, 2025.0.12, 2026.0.2.

How is CVE-2026-127236 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-127236?

Check whether you run OpenNMS Horizon or OpenNMS Meridian at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-127236: OpenNMS Meridian and Horizon argument injection in RRD graph

CVE-2026-127236 · Severity: medium · CVSS 5.4 · Published 2026-11-12

OpenNMS Meridian and Horizon are network monitoring and management platforms used to track infrastructure health. An authenticated attacker with basic user privileges can manipulate graph generation requests to inject arguments into the underlying rrdtool command, enabling server-side request forgery to connect to attacker-controlled servers or reading of arbitrary local RRD files. The vulnerability requires prior authentication and does not allow full command execution.

Technologies: OpenNMS Horizon, OpenNMS Meridian. Vendors: OpenNMS.

Quick answers

Is CVE-2026-127236 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-127236 being exploited in the wild.
How severe is CVE-2026-127236?: Medium severity, with a CVSS score of 5.4, published 12 November 2026.
Which products and versions are affected?: OpenNMS Horizon before 36.0.6; OpenNMS Meridian before 2024.3.15, 2025.0.12, 2026.0.2.
Is there a fix for CVE-2026-127236?: Yes: fixed in Meridian 2024.3.15, 2025.0.12, 2026.0.2 and Horizon 36.0.6 or newer. Until then: Restrict network access to OpenNMS installations to private networks only; installation instructions recommend deployment within an organization's private network rather than direct Internet exposure.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-11-12", "note": "CVE published" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-127236 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-127236?: Check whether you run OpenNMS Horizon or OpenNMS Meridian at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Meridian 2024.3.15, 2025.0.12, 2026.0.2 and Horizon 36.0.6 or newer

Restrict network access to OpenNMS installations to private networks only; installation instructions recommend deployment within an organization's private network rather than direct Internet exposure.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-11-12", "note": "CVE published" } ]

Technical details

An argument injection vulnerability exists in the ad-hoc RRD graph endpoint (GET /graph/graph.png?adhoc=true) where request parameters are passed unsanitized to rrdtool command invocation. A low-privileged authenticated user (ROLE_USER or ROLE_DASHBOARD) can inject rrdtool arguments such as --daemon (SSRF) or DEF statements (local file read). The command executes via exec with an argument array, preventing shell-based OS command execution. The fix applies allowlist validation to graph parameters.

Affected products

OpenNMS Meridian before 2024.3.15, 2025.0.12, 2026.0.2
OpenNMS Horizon before 36.0.6

References

https://github.com/OpenNMS/opennms/pull/9065

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.