CVE-2026-89054

OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes

Published Sep 10, 2026 CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Description

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration and SNMP data collection (which enable and disable event definitions and data-collection sources) are reachable with no authorization enforced. An unauthenticated attacker able to reach the web UI can disable event definitions and SNMP data collection, suppressing event and alarm generation and stopping metric collection - silently degrading monitoring and detection - with the change persisted and reloaded into the running system.

The solution is to upgrade to Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Analysis

Technical impact

A missing authorization check on PATCH endpoints in the /api/v2 REST API of OpenNMS Horizon allows an unauthenticated attacker who can reach the web UI to invoke configuration actions without credentials. Through these endpoints, an attacker can enable or disable event definitions and SNMP data‑collection sources, causing the system to stop generating alarms and metrics and effectively silencing alerts without any indication to administrators.

Affected Systems

The flaw affects installations of OpenNMS Horizon prior to version 36.0.4. All Horizon deployments that expose the /api/v2 REST endpoints, such as the36.0.3 releases, are vulnerable. The vendor’s installation guidelines state that Horizon should run within private networks and should not be directly exposed to the Internet.

Risk and Exploitability

The vulnerability receives a CVSS score of 8.2, classifying it as high severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is the web interface; an attacker must have network reach to the Horizon server to exploit the unauthenticated PATCH calls. Due to the absence of denial of monitoring services, which can have serious operational impact in a production environment.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

The OpenNMS Group

Horizon

unaffected

Version	Status	Constraints
`36.0.0`	affected	< 36.0.4

No data.

Vendor Product Versions

The Opennms Group

Horizon

Version	Status	Scheme	Platform
`[36.0.0,36.0.4)`	affected	semver	—

Remediation

Vendor Solution

Upgrade to Horizon 36.0.4 or newer.

OpenCVE Recommended Actions

Upgrade OpenNMS Horizon to version 36.0.4 or newer to address the missing authorization check on PATCH endpoints.
Ensure Horizon is deployed behind a firewall and that the /api/v2 REST interface is only accessible from trusted internal networks; block public access to prevent unauthenticated use.
Enable comprehensive logging of all PATCH requests and regularly audit logs for unexpected changes to event definitions and SNMP data collection sources.

Generated by OpenCVE AI on September 10, 2026 at 23:15 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.510% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/OpenNMS/opennms/pull/8833

History

Sep 13, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		The Opennms Group The Opennms Group horizon
Vendors & Products		The Opennms Group The Opennms Group horizon

Sep 10, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 10, 2026 7:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration and SNMP data collection (which enable and disable event definitions and data-collection sources) are reachable with no authorization enforced. An unauthenticated attacker able to reach the web UI can disable event definitions and SNMP data collection, suppressing event and alarm generation and stopping metric collection - silently degrading monitoring and detection - with the change persisted and reloaded into the running system. The solution is to upgrade to Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
Title		OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes
Weaknesses		CWE-862
References		https://github.com/OpenNMS/opennms/pull/8833
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L'}`