CVE-2026-127236 · Package
NO FIX YET · SEE WHAT TO DO
The ad-hoc RRD graph endpoint in OpenNMS Meridian and Horizon copies request parameters into the rrdtool command line without validation. A logged-in low-privileged user can add rrdtool arguments to make the server connect to an address they choose (SSRF) or read local RRD files by absolute path, though not run operating system commands.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Organizations running OpenNMS Meridian or Horizon versions with the ad-hoc graph feature. Exposure needs a valid account with ROLE_USER or ROLE_DASHBOARD. The vendor says these products are meant for private networks and should not be reachable from the internet, which limits exposure.
Not affected if not-internet-exposed, patched-version
Who cares horizon, meridian, opennms, self-hosted
GET /graph/graph.png?adhoc=true in web server access logs for unusual parameters.2024.3.15, 2025.0.12, 2026.0.236.0.6 or newerAn argument injection vulnerability exists in the ad-hoc RRD graph feature of multiple versions of OpenNMS Meridian and Horizon. The ad-hoc graph endpoint (GET /graph/graph.png?adhoc=true) copies request parameters into the rrdtool command line without validation. A low-privileged authenticated user (ROLE_USER or ROLE_DASHBOARD) can insert extra rrdtool arguments. An injected --daemon argument makes the server connect to an attacker-chosen address, which is a server-side request forgery. An injected DEF statement reads a local RRD file by absolute path. The command runs through exec with an argument array and no shell, so arbitrary operating system command execution is not possible. The fix validates the ad-hoc graph parameters against allowlists.
The solution is to upgrade to Meridian 2024.3.15, 2025.0.12, 2026.0.2 and Horizon 36.0.6 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.