Executive brief
OpenNMS Meridian and Horizon are network monitoring and management platforms used by organizations to track and manage their IT infrastructure. A SQL injection vulnerability in the built-in reporting feature allows authenticated users to execute arbitrary database queries and steal sensitive credentials such as SNMP community strings and provisioning passwords stored in the system database. This could lead to unauthorized access to monitored network devices and exposure of critical operational secrets.
Technical details
A SQL injection vulnerability exists in the JasperReports-based reporting feature affecting the "Maintenance contracts expired" and "Maintenance contracts strategy" reports. The vulnerability stems from unsafe parameter substitution in report templates, where user-supplied DATE_FORMAT parameters are substituted directly into SQL queries without proper escaping. An authenticated user with ROLE_USER privilege can invoke these reports via the REST API (POST /rest/reports/{id}) and inject SQL through the DATE_FORMAT parameter to execute arbitrary queries. This allows reading arbitrary database contents including credentials and SNMP community strings. The fix involves binding parameters using proper parameterized query syntax instead of direct literal substitution, and patches are available in Meridian 2024.3.13, 2025.0.10, and Horizon 36.0.4 or newer.
Affected products
- OpenNMS Meridian versions prior to 2024.3.13, 2025.0.10
- OpenNMS Horizon versions prior to 36.0.4
Timeline
- 2026-09-10: disclosed: CVE-2026-89089 published
- 2026-09-02: patched: Patch merged in GitHub PR #8832