{"id":"CVE-2026-127235","kind":"vulnerability","aliases":["CVE-2026-127235"],"related":[],"title":"OpenNMS Meridian and Horizon: reflected XSS steals authenticated sessions via crafted link","description":"A reflected cross-site scripting vulnerability exists in the web user interface of multiple versions of OpenNMS Meridian and Horizon. Several web UI pages copy request parameter values into the HTML response without correct contextual output encoding. A remote attacker can craft a link that runs arbitrary JavaScript in the OpenNMS origin when an authenticated user opens it. The script runs in the victim's browser with the victim's session, so the attacker can read page data and send same-origin requests as the victim. The fix encodes the affected request values. On pages that use AngularJS, the fix also stops client-side template evaluation of the reflected values.\n\n\n\nThe solution is to upgrade to Meridian 2024.3.15, 2025.0.12, 2026.0.2 and Horizon 36.0.6 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.","summary":"Several web UI pages in OpenNMS Meridian and Horizon echo request parameters into the HTML without proper encoding. An attacker who gets an authenticated user to open a crafted link can run JavaScript in the OpenNMS origin with that user's session.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["horizon","meridian","opennms","runtime","self-hosted"],"not_affected_if":["versions-already-patched"],"how_to_check":"- Check the installed Meridian or Horizon version against the fixed versions below.","fix":"- Meridian: upgrade to `2024.3.15`, `2025.0.12` or `2026.0.2`, whichever matches your release line.\n- Horizon: upgrade to `36.0.6` or newer.","status":"open","published_at":"2026-11-12T19:17:03+00:00","first_seen_at":"2026-11-12T19:40:14+00:00","triaged_at":"2026-11-12T19:40:53+00:00","updated_at":"2026-11-12T19:40:53+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T19:40:53Z","model":"claude-haiku-5-5","output":{"fix":"- Meridian: upgrade to `2024.3.15`, `2025.0.12` or `2026.0.2`, whichever matches your release line.\n- Horizon: upgrade to `36.0.6` or newer.","reach":"network","title":"OpenNMS Meridian and Horizon: reflected XSS steals authenticated sessions via crafted link","impact":"medium","summary":"Several web UI pages in OpenNMS Meridian and Horizon echo request parameters into the HTML without proper encoding. An attacker who gets an authenticated user to open a crafted link can run JavaScript in the OpenNMS origin with that user's session.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["opennms","meridian","horizon","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs scripts as a logged-in user, reading page data and acting as them","analyst_note":"","how_to_check":"- Check the installed Meridian or Horizon version against the fixed versions below.\n- unknown for any other check; the sources do not give one.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["versions-already-patched"],"who_is_affected":"Organisations running OpenNMS Meridian or Horizon web UI on multiple versions. The attack needs a logged-in user to open a crafted link. The sources say installs are meant for private networks and not internet-facing, which lowers exposure but does not remove the link-based risk to internal users.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000758,"input_tokens":4762,"output_tokens":563,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-127235':15A,18A '-2026':14A,17A '2024.3.15':188C '2025.0.12':189C '2026.0.2':190C '36.0.6':193C 'access':219C 'affect':160C 'also':170C 'angularj':167C 'arbitrari':115C 'attack':45B,108C,142C 'authent':8A,49B,123C 'browser':134C 'client':173C 'client-sid':172C 'contextu':103C 'copi':93C 'correct':102C 'craft':11A,54B,110C 'cross':71C 'cross-sit':70C 'cve':13A,16A 'data':146C 'direct':218C 'echo':35B 'encod':43B,105C,158C 'evalu':176C 'exist':75C 'fix':157C,169C 'get':47B 'horizon':4A,19B,34B,88C,192C,198C 'host':25B 'html':40B,99C 'instal':199C,207C 'instruct':200C 'intend':205C 'interfac':80C 'internet':222C 'javascript':58B,116C 'link':12A,55B,112C 'meridian':2A,20B,32B,86C,187C,196C 'multipl':82C 'network':213C 'newer':195C 'open':52B,125C 'opennm':1A,21B,31B,61B,85C,119C 'organ':210C 'origin':62B,120C,151C 'output':104C 'page':29B,92C,145C,164C 'paramet':37B,95C 'privat':212C 'proper':42B 'read':144C 'reflect':5A,69C,179C 'remot':107C 'request':36B,94C,152C,161C 'respons':100C 'run':57B,114C,129C 'runtim':22B 'same-origin':149C 'script':73C,128C 'self':24B 'self-host':23B 'send':148C 'session':9A,67B,139C 'sever':26B,89C 'side':174C 'site':72C 'solut':182C 'state':201C 'steal':7A 'stop':171C 'templat':175C 'ui':28B,91C 'upgrad':185C 'use':166C 'user':50B,65B,79C,124C 'valu':96C,162C,180C 'version':83C 'via':10A 'victim':132C,137C,155C 'vulner':74C 'web':27B,78C,90C 'within':208C 'without':41B,101C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Organisations running OpenNMS Meridian or Horizon web UI on multiple versions. The attack needs a logged-in user to open a crafted link. The sources say installs are meant for private networks and not internet-facing, which lowers exposure but does not remove the link-based risk to internal users.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["horizon","medium","meridian","opennms","runtime","selfhosted"],"campaign_type":null,"search_a":"'-127235':15A,18A '-2026':14A,17A 'authent':8A 'craft':11A 'cve':13A,16A 'horizon':4A 'link':12A 'meridian':2A 'opennm':1A 'reflect':5A 'session':9A 'steal':7A 'via':10A 'xss':6A","search_b":"'attack':45B 'authent':49B 'craft':54B 'echo':35B 'encod':43B 'get':47B 'horizon':19B,34B 'host':25B 'html':40B 'javascript':58B 'link':55B 'meridian':20B,32B 'open':52B 'opennm':21B,31B,61B 'origin':62B 'page':29B 'paramet':37B 'proper':42B 'request':36B 'run':57B 'runtim':22B 'self':24B 'self-host':23B 'session':67B 'sever':26B 'ui':28B 'user':50B,65B 'web':27B 'without':41B","search_c":"'2024.3.15':188C '2025.0.12':189C '2026.0.2':190C '36.0.6':193C 'access':219C 'affect':160C 'also':170C 'angularj':167C 'arbitrari':115C 'attack':108C,142C 'authent':123C 'browser':134C 'client':173C 'client-sid':172C 'contextu':103C 'copi':93C 'correct':102C 'craft':110C 'cross':71C 'cross-sit':70C 'data':146C 'direct':218C 'encod':105C,158C 'evalu':176C 'exist':75C 'fix':157C,169C 'horizon':88C,192C,198C 'html':99C 'instal':199C,207C 'instruct':200C 'intend':205C 'interfac':80C 'internet':222C 'javascript':116C 'link':112C 'meridian':86C,187C,196C 'multipl':82C 'network':213C 'newer':195C 'open':125C 'opennm':85C,119C 'organ':210C 'origin':120C,151C 'output':104C 'page':92C,145C,164C 'paramet':95C 'privat':212C 'read':144C 'reflect':69C,179C 'remot':107C 'request':94C,152C,161C 'respons':100C 'run':114C,129C 'same-origin':149C 'script':73C,128C 'send':148C 'session':139C 'sever':89C 'side':174C 'site':72C 'solut':182C 'state':201C 'stop':171C 'templat':175C 'ui':91C 'upgrad':185C 'use':166C 'user':79C,124C 'valu':96C,162C,180C 'version':83C 'victim':132C,137C,155C 'vulner':74C 'web':78C,90C 'within':208C 'without':101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T19:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security@opennms.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127235","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127235","severity":null,"published_at":"2026-11-12T19:17:03+00:00","modified_at":"2026-11-12T19:17:03+00:00","first_seen_at":"2026-11-12T19:40:14+00:00","fetched_at":"2026-11-12T19:40:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}