An HTTP method case‑sensitivity bug in the OpenNMS REST API allows unauthenticated callers to bypass Spring Security’s intercept‑url rules when they use a non‑canonical (for example lowercase) HTTP method token. Because the filter chain has no terminal deny rule, requests with these methods are served without authentication, giving attackers full read and write access to the monitored inventory, the ability to create, modify, or delete resources, and the capacity to inject or suppress alarm events. The vulnerability therefore exposes confidentiality, integrity, and availability of the system’s monitoring data.

Affected deployments are OpenNMS Meridian installations older than version 2024.3.14, 2025.0.11, or 2026.0.1, and OpenNMS Horizon installations older than version 36.0.5. The fix adds a terminal deny rule to each REST filter chain.

With a CVSS score of 9.1 the risk is considered critical. The EPSS score of less than 1% indicates the probability of exploitation is low, and the vulnerability is not yet listed in CISA’s KEV catalog. Exploitation requires remote reachability of the OpenNMS REST endpoints and the use of a non‑canonical HTTP method, which suggests the risk is primarily internal to an organization’s private network, though the product’s documentation warns against exposing the API to the Internet.