CVE-2026-127235 · Runtime
NO FIX YET · SEE WHAT TO DO
Several web UI pages in OpenNMS Meridian and Horizon echo request parameters into the HTML without proper encoding. An attacker who gets an authenticated user to open a crafted link can run JavaScript in the OpenNMS origin with that user's session.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Organisations running OpenNMS Meridian or Horizon web UI on multiple versions. The attack needs a logged-in user to open a crafted link. The sources say installs are meant for private networks and not internet-facing, which lowers exposure but does not remove the link-based risk to internal users.
Not affected if versions-already-patched
Who cares horizon, meridian, opennms, self-hosted
2024.3.15, 2025.0.12 or 2026.0.2, whichever matches your release line.36.0.6 or newer.A reflected cross-site scripting vulnerability exists in the web user interface of multiple versions of OpenNMS Meridian and Horizon. Several web UI pages copy request parameter values into the HTML response without correct contextual output encoding. A remote attacker can craft a link that runs arbitrary JavaScript in the OpenNMS origin when an authenticated user opens it. The script runs in the victim's browser with the victim's session, so the attacker can read page data and send same-origin requests as the victim. The fix encodes the affected request values. On pages that use AngularJS, the fix also stops client-side template evaluation of the reflected values.
The solution is to upgrade to Meridian 2024.3.15, 2025.0.12, 2026.0.2 and Horizon 36.0.6 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.