CVE-2026-89054 in Horizon
Summary
by MITRE • 09/10/2026
A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration and SNMP data collection (which enable and disable event definitions and data-collection sources) are reachable with no authorization enforced. An unauthenticated attacker able to reach the web UI can disable event definitions and SNMP data collection, suppressing event and alarm generation and stopping metric collection - silently degrading monitoring and detection - with the change persisted and reloaded into the running system.
The solution is to upgrade to Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
A critical missing authorization vulnerability exists within OpenNMS Horizon, specifically affecting versions prior to 36.0.4. This flaw stems from a misconfiguration in the Spring Security policy governing the /api/v2 REST API interface. While the security framework correctly defines and enforces authorization rules for most HTTP methods such as GET, POST, PUT, and DELETE, it inadvertently omits enforcement for the PATCH method on specific configuration endpoints. These unprotected endpoints manage event definitions and SNMP data collection sources, which are fundamental components of the monitoring infrastructure's ability to detect anomalies and collect performance metrics. Consequently, any user or automated script capable of sending HTTP requests to these API paths can modify system configurations without providing valid credentials or session tokens.
The operational impact of this vulnerability is severe for organizations relying on OpenNMS Horizon for network visibility and security operations. An unauthenticated attacker with network access to the web interface can exploit this flaw to disable event definitions, which are rules that trigger alerts when specific conditions are met. Simultaneously, the attacker can disable SNMP data collection sources, which are responsible for gathering performance metrics from managed devices. By suppressing these functions, the monitoring system effectively goes blind and deaf regarding the affected configurations. This results in a silent degradation of monitoring capabilities where alarms cease to generate and metric collection stops entirely. Such an attack does not necessarily cause immediate service disruption but rather creates a stealthy window of opportunity for further malicious activity by removing the primary detection mechanisms that would otherwise alert administrators to intrusions or failures.
From a threat modeling perspective, this vulnerability aligns with CWE-862, which describes missing authorization checks in access control logic. The attack vector allows an adversary to manipulate system state without authentication, facilitating actions such as disabling security controls and obscuring malicious activity. In the context of the MITRE ATT&CK framework, this behavior corresponds to Defense Evasion techniques where attackers disable or interfere with defensive mechanisms like logging and monitoring services to avoid detection during a potential intrusion campaign. The persistence of these changes ensures that even if the initial attack vector is closed, the system remains in a degraded state until an administrator manually intervenes to restore the configuration through alternative means not exposed via the vulnerable API endpoints.
Mitigation for this issue requires immediate action by upgrading OpenNMS Horizon to version 36.0.4 or any later release where the Spring Security policy has been corrected to include proper authorization checks for PATCH requests on these critical configuration endpoints. Organizations should also review their network architecture and access control policies. Official installation guidelines emphasize that both Meridian and Horizon are designed for deployment within private, internal networks rather than being directly exposed to the public internet. Ensuring that the web interface is not accessible from untrusted external networks significantly reduces the attack surface by preventing unauthenticated actors from reaching these API endpoints in the first place. Regular security audits of REST API configurations and adherence to least-privilege principles for service accounts are recommended best practices to prevent similar misconfigurations in future deployments.