CVE-2026-19135: OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classes
A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an attacker to gain access to confidential information and compromise integrity.
The solution is to upgrade to Meridian 2024.3.12, 2025.0.9 and Horizon 36.0.3 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenNMS Meridianto a version that resolves this vulnerability.Fixed in 2024.3.12 - Upgrade
Upgrade
OpenNMS Meridianto a version that resolves this vulnerability.Fixed in 2025.0.9 - Upgrade
Upgrade
OpenNMS Horizonto a version that resolves this vulnerability.Fixed in 36.0.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19135?
CVE-2026-19135 has a medium severity rating of 5.4.
How does CVE-2026-19135 affect OpenNMS?
CVE-2026-19135 allows a low-privileged authenticated user to bypass the JEXL expression sandbox in the Measurements REST API and load arbitrary Java classes on the server.
Who is affected by CVE-2026-19135?
OpenNMS users with versions of Meridian and Horizon that are vulnerable to this JEXL sandbox bypass are at risk.
How can I mitigate CVE-2026-19135?
To mitigate CVE-2026-19135, upgrade to the latest fixed versions of OpenNMS Meridian and Horizon as soon as possible.
What kind of attack can CVE-2026-19135 enable?
CVE-2026-19135 can potentially allow an attacker to execute arbitrary code on the server due to class loading capabilities.