---
id: "CVE-2026-127235"
page: "https://infrastack.ai/live/CVE-2026-127235"
kind: "vulnerability"
aliases: ["CVE-2026-127235"]
title: "OpenNMS Meridian and Horizon: reflected XSS steals authenticated sessions via crafted link"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["horizon", "meridian", "opennms", "runtime", "self-hosted"]
not_affected_if: ["versions-already-patched"]
published_at: "2026-11-12T19:17:03+00:00"
first_seen_at: "2026-11-12T19:40:14+00:00"
updated_at: "2026-11-12T19:40:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127235", "first_seen_at": "2026-11-12T19:40:14+00:00"}]
exploit_sources: []
---

# OpenNMS Meridian and Horizon: reflected XSS steals authenticated sessions via crafted link

Link for people: https://infrastack.ai/live/CVE-2026-127235 (this .md is for agents)

Several web UI pages in OpenNMS Meridian and Horizon echo request parameters into the HTML without proper encoding. An attacker who gets an authenticated user to open a crafted link can run JavaScript in the OpenNMS origin with that user's session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Meridian or Horizon version against the fixed versions below.

## Fix

- Meridian: upgrade to `2024.3.15`, `2025.0.12` or `2026.0.2`, whichever matches your release line.
- Horizon: upgrade to `36.0.6` or newer.

## Timeline

- 2026-11-12T19:40:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127235

## From the sources

A reflected cross-site scripting vulnerability exists in the web user interface of multiple versions of OpenNMS Meridian and Horizon. Several web UI pages copy request parameter values into the HTML response without correct contextual output encoding. A remote attacker can craft a link that runs arbitrary JavaScript in the OpenNMS origin when an authenticated user opens it. The script runs in the victim's browser with the victim's session, so the attacker can read page data and send same-origin requests as the victim. The fix encodes the affected request values. On pages that use AngularJS, the fix also stops client-side template evaluation of the reflected values.



The solution is to upgrade to Meridian 2024.3.15, 2025.0.12, 2026.0.2 and Horizon 36.0.6 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_