# CVE-2026-89089: OpenNMS Meridian and Horizon SQL injection in JasperReports

Source: https://junglewise.ai/threats/cve-2026-89089-opennms-meridian-and-horizon-sql-injection-in-jasperreports  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-89089 · Severity: medium · CVSS 6.5 · Published 2026-09-10

OpenNMS Meridian and Horizon are network monitoring and management platforms used by organizations to track and manage their IT infrastructure. A SQL injection vulnerability in the built-in reporting feature allows authenticated users to execute arbitrary database queries and steal sensitive credentials such as SNMP community strings and provisioning passwords stored in the system database. This could lead to unauthorized access to monitored network devices and exposure of critical operational secrets.

Technologies: [OpenNMS Meridian](https://junglewise.ai/threats/technologies/meridian). Vendors: [OpenNMS](https://junglewise.ai/threats/vendors/opennms).

## Quick answers

**Is CVE-2026-89089 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89089 being exploited in the wild.

**How severe is CVE-2026-89089?** Medium severity, with a CVSS score of 6.5, published 10 September 2026.

**Which products and versions are affected?** OpenNMS Meridian versions prior to 2024.3.13, 2025.0.10.

**Is there a fix for CVE-2026-89089?** A patch was published on 2026-09-02: Patch merged in GitHub PR #8832 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-89089 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-89089?** Check whether you run OpenNMS Meridian at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the JasperReports-based reporting feature affecting the "Maintenance contracts expired" and "Maintenance contracts strategy" reports. The vulnerability stems from unsafe parameter substitution in report templates, where user-supplied DATE_FORMAT parameters are substituted directly into SQL queries without proper escaping. An authenticated user with ROLE_USER privilege can invoke these reports via the REST API (POST /rest/reports/{id}) and inject SQL through the DATE_FORMAT parameter to execute arbitrary queries. This allows reading arbitrary database contents including credentials and SNMP community strings. The fix involves binding parameters using proper parameterized query syntax instead of direct literal substitution, and patches are available in Meridian 2024.3.13, 2025.0.10, and Horizon 36.0.4 or newer.

## Affected products

- OpenNMS Meridian versions prior to 2024.3.13, 2025.0.10
- OpenNMS Horizon versions prior to 36.0.4

## Timeline

- 2026-09-10: disclosed: CVE-2026-89089 published
- 2026-09-02: patched: Patch merged in GitHub PR #8832

## References

- [https://github.com/OpenNMS/opennms/pull/8832](https://github.com/OpenNMS/opennms/pull/8832)

## Related threats

- [OpenNMS Meridian and Horizon argument injection in RRD graph](https://junglewise.ai/threats/cve-2026-127236-an-argument-injection-vulnerability-exists-in-the-ad-hoc-rrd)
- [OpenNMS Meridian and Horizon reflected cross-site scripting in web UI](https://junglewise.ai/threats/cve-2026-127235-a-reflected-cross-site-scripting-vulnerability-exists-in-the-web)
- [OpenNMS Meridian and Horizon XML entity expansion denial of service](https://junglewise.ai/threats/cve-2026-111252-a-denial-of-service-vulnerability-exists-in-the-xml-parsing-of)
- [OpenNMS Meridian and Horizon REST API authorization bypass](https://junglewise.ai/threats/cve-2026-111235-an-authorization-bypass-vulnerability-exists-in-the-rest-api-of)
- [OpenNMS XML External Entity injection in XML collector](https://junglewise.ai/threats/cve-2026-19596-opennms-xml-external-entity-injection-in-xml-collector)