CVE-2026-89089

OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)

View on CVE.org
Published Sep 10, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user (ROLE_USER) can run the shipped, default-enabled online reports "Maintenance contracts expired" (AssetManagementMaintExpired) and "Maintenance contracts strategy" (AssetManagementMaintStrategy) via the reporting REST API (POST /rest/reports/{id}) and supply a DATE_FORMAT parameter that the report templates substitute literally, un-escaped, into their SQL queries. This lets an attacker execute arbitrary SQL against the OpenNMS database and read arbitrary data, including database-stored secrets such as provisioning and notification credentials and SNMP community strings.



The solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Analysis

AI-generated

Technical impact

A low‑privileged authenticated user can inject SQL by supplying a DATE_FORMAT parameter to the JasperReports‑based reporting REST API. The report templates use this value unescaped, allowing arbitrary SQL to be run against the OpenNMS database. As a result, an attacker can read confidential data, including provisioning credentials, notification secrets, and SNMP community strings, which is a direct breach of confidentiality.

Affected Systems

The vulnerability is found in multiple versions of The OpenNMS Group Horizon and Meridian. All builds prior to Horizon 36.0.4 and Meridian 2024.3.13 (or 2025.0.10) are affected. The manufacturers recommend upgrading to these or newer releases.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity, and the vulnerability is not listed in CISA KEV. Exploitation requires authentication as a ROLE_USER. Based on the is exposed to the Internet or a trusted network, an attacker could abuse the REST API. The potential impact is significant data breach and credential compromise, making the risk noteworthy despite the lack of a public exploit. Monitoring for anomalous report execution and restricting network access mitigates the attack likelihood.

Remediation

Vendor Solution

Upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer.

OpenCVE Recommended Actions

  • Apply the official patch by upgrading to Meridian 2024.3.13, 2025.0.10 or newer, or Horizon 36.0.4 or newer.
  • Re‑configure the deployment so that the OpenNMS services, especially the REST API, are not reachable directly from the Internet and are only accessible through a trusted the default "Maintenance contracts expired" and "Maintenance contracts strategy" reports until the upgrade is completed or administrative users have validated the setup.
  • Configure JasperReports to reject or sanitize the DATE_FORMAT parameter, or disable the vulnerable reports until the patch is applied.

Generated by OpenCVE AI on September 10, 2026 at 23:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared The Opennms Group
The Opennms Group horizon
The Opennms Group meridian
Vendors & Products The Opennms Group
The Opennms Group horizon
The Opennms Group meridian
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user (ROLE_USER) can run the shipped, default-enabled online reports "Maintenance contracts expired" (AssetManagementMaintExpired) and "Maintenance contracts strategy" (AssetManagementMaintStrategy) via the reporting REST API (POST /rest/reports/{id}) and supply a DATE_FORMAT parameter that the report templates substitute literally, un-escaped, into their SQL queries. This lets an attacker execute arbitrary SQL against the OpenNMS database and read arbitrary data, including database-stored secrets such as provisioning and notification credentials and SNMP community strings. The solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
Title OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}
Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
OpenNMS
Published
Updated
Sep 11, 2026, 2:51 PM
Reserved
Sep 10, 2026, 8:09 PM

View source JSON

Updated
Sep 11, 2026, 2:51 PM

JSON

Status
Awaiting Analysis
Published
Sep 10, 2026, 9:17 PM
Modified
Sep 18, 2026, 7:21 PM

View source JSON

No data.

Updated
Sep 13, 2026, 7:59 PM

JSON