CVE-2026-127235: OpenNMS reflected cross-site scripting in the web UI via request parameters
A reflected cross-site scripting vulnerability exists in the web user interface of multiple versions of OpenNMS Meridian and Horizon. Several web UI pages copy request parameter values into the HTML response without correct contextual output encoding. A remote attacker can craft a link that runs arbitrary JavaScript in the OpenNMS origin when an authenticated user opens it. The script runs in the victim's browser with the victim's session, so the attacker can read page data and send same-origin requests as the victim. The fix encodes the affected request values. On pages that use AngularJS, the fix also stops client-side template evaluation of the reflected values.
The solution is to upgrade to Meridian 2024.3.15, 2025.0.12, 2026.0.2 and Horizon 36.0.6 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenNMS Meridianto a version that resolves this vulnerability.Fixed in 2024.3.15 - Upgrade
Upgrade
OpenNMS Meridianto a version that resolves this vulnerability.Fixed in 2025.0.12 - Upgrade
Upgrade
OpenNMS Meridianto a version that resolves this vulnerability.Fixed in 2026.0.2 - Upgrade
Upgrade
OpenNMS Horizonto a version that resolves this vulnerability.Fixed in 36.0.6
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must craft a URL containing malicious request parameter values and convince an authenticated OpenNMS user to open it. Exploitation requires user interaction but does not require the attacker to authenticate.
Who is exposed if exploitation succeeds?
Any authenticated user who opens a crafted link can have JavaScript executed in their browser under the OpenNMS origin. The script can read data available to that user's session and make same-origin requests with that user's permissions.
Are Internet-exposed deployments at greater risk?
Yes. OpenNMS installation guidance states that Meridian and Horizon are intended for private organizational networks and should not be directly accessible from the Internet; direct Internet exposure makes it easier for remote attackers to deliver crafted links to users.
What versions contain the fix?
Upgrade Meridian to 2024.3.15, 2025.0.12, or 2026.0.2 or newer, or upgrade Horizon to 36.0.6 or newer. The fixes add contextual output encoding and, for affected AngularJS pages, prevent client-side template evaluation of reflected values.