CVE-2026-89089 in Horizon
Summary
by MITRE • 09/10/2026
A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user (ROLE_USER) can run the shipped, default-enabled online reports "Maintenance contracts expired" (AssetManagementMaintExpired) and "Maintenance contracts strategy" (AssetManagementMaintStrategy) via the reporting REST API (POST /rest/reports/{id}) and supply a DATE_FORMAT parameter that the report templates substitute literally, un-escaped, into their SQL queries. This lets an attacker execute arbitrary SQL against the OpenNMS database and read arbitrary data, including database-stored secrets such as provisioning and notification credentials and SNMP community strings.
The solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
A critical SQL injection vulnerability has been identified in the JasperReports-based reporting subsystem of OpenNMS Meridian and Horizon platforms, affecting multiple software versions prior to their respective patched releases. This flaw allows a low-privileged authenticated user with the ROLE_USER permission level to execute arbitrary Structured Query Language commands against the underlying database infrastructure. The attack vector is specifically tied to the online reports named Maintenance contracts expired (AssetManagementMaintExpired) and Maintenance contracts strategy (AssetManagementMaintStrategy). These report templates are shipped as part of the default installation package and remain enabled by default, providing an immediate and accessible entry point for exploitation without requiring any custom configuration or additional setup steps.
The technical root cause lies in how the application handles user-supplied input within these specific report definitions. When a user invokes one of these reports via the reporting REST API endpoint POST /rest/reports/{id}, they can supply a DATE_FORMAT parameter intended to control date display formatting. However, the underlying JasperReports template engine substitutes this parameter value literally into the SQL query string without performing any sanitization or escaping operations. This lack of input validation means that maliciously crafted strings containing SQL syntax are passed directly to the database management system for execution. Consequently, an attacker can manipulate the structure of the intended query to perform unauthorized data retrieval, modification, or deletion actions.
The operational impact of this vulnerability is severe due to the high level of access granted by the OpenNMS application role and the sensitivity of the data stored within its database. By exploiting this SQL injection flaw, an adversary can read arbitrary tables from the database schema. This includes highly sensitive credentials such as provisioning secrets, notification account passwords, and SNMP community strings used for network device communication. The exposure of these credentials compromises not only the confidentiality of the OpenNMS system itself but also potentially extends to other managed devices that rely on these shared or related authentication mechanisms. Furthermore, depending on the database engine configuration and privileges granted to the application user, there may be potential for further exploitation leading to remote code execution or complete system compromise through out-of-band techniques like xp_cmdshell in Microsoft SQL Server or similar functions in other databases.
This vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command and is categorized under ATT&CK technique T1059 Command and Scripting Interpreter, specifically within the context of database command injection. The attack scenario reflects a common pattern where application-level logic fails to properly separate code from data when constructing dynamic queries based on user input. The presence of default-enabled reports with known flaws significantly increases the risk surface area, as attackers do not need to discover obscure features but can target widely available functionality that is present in standard installations.
To mitigate this vulnerability and restore security posture, organizations running affected versions of OpenNMS Meridian or Horizon must upgrade immediately to patched releases. Specifically, users should migrate to Meridian version 2024.3.13 or later, or Horizon version 36.0.4 or newer. These updates contain the necessary code changes to properly sanitize and escape user-supplied parameters within the JasperReports templates. In addition to upgrading software, administrators should review their network architecture to ensure that OpenNMS instances are not directly exposed to untrusted networks such as the public internet. The installation guidelines for both Meridian and Horizon explicitly state that these systems are designed for deployment within private organizational networks. Implementing proper network segmentation, firewalls, and access control lists will provide a critical layer of defense-in-depth, limiting exposure even if application-level vulnerabilities exist or new ones emerge in the future.