Vulnerability-Lookup

CVE-2026-89089 (GCVE-0-2026-89089)

Vulnerability from cvelistv5 – Published: 2026-09-10 20:30 – Updated: 2026-09-11 14:51

Title

OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)

Summary

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user (ROLE_USER) can run the shipped, default-enabled online reports "Maintenance contracts expired" (AssetManagementMaintExpired) and "Maintenance contracts strategy" (AssetManagementMaintStrategy) via the reporting REST API (POST /rest/reports/{id}) and supply a DATE_FORMAT parameter that the report templates substitute literally, un-escaped, into their SQL queries. This lets an attacker execute arbitrary SQL against the OpenNMS database and read arbitrary data, including database-stored secrets such as provisioning and notification credentials and SNMP community strings. The solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-11 14:51 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

OpenNMS mitre root

References

1 reference

URL	Tags
https://github.com/OpenNMS/opennms/pull/8832	patch

Impacted products

2 products

Vendor	Product	Version	CPE status
The OpenNMS Group	Meridian	Affected: 2024.1.0 , < 2024.3.13 (maven) Affected: 2025.0.0 , < 2025.0.10 (maven)	guessed
The OpenNMS Group	Horizon	Affected: 36.0.0 , < 36.0.4 (maven)	guessed

Credits

Xanlar Agamalizade

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89089",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T14:51:29.896443Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T14:51:40.860Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Meridian",
          "repo": "https://github.com/OpenNMS",
          "vendor": "The OpenNMS Group",
          "versions": [
            {
              "lessThan": "2024.3.13",
              "status": "affected",
              "version": "2024.1.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2025.0.10",
              "status": "affected",
              "version": "2025.0.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Horizon",
          "repo": "https://github.com/OpenNMS",
          "vendor": "The OpenNMS Group",
          "versions": [
            {
              "lessThan": "36.0.4",
              "status": "affected",
              "version": "36.0.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Xanlar Agamalizade"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user (ROLE_USER) can run the shipped, default-enabled online reports \"Maintenance contracts expired\" (AssetManagementMaintExpired) and \"Maintenance contracts strategy\" (AssetManagementMaintStrategy) via the reporting REST API (POST /rest/reports/{id}) and supply a DATE_FORMAT parameter that the report templates substitute literally, un-escaped, into their SQL queries. This lets an attacker execute arbitrary SQL against the OpenNMS database and read arbitrary data, including database-stored secrets such as provisioning and notification credentials and SNMP community strings.\u003c/p\u003e\u003cp\u003eThe solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization\u0027s private networks and should not be directly accessible from the Internet.\u003c/p\u003e"
            }
          ],
          "value": "A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user (ROLE_USER) can run the shipped, default-enabled online reports \"Maintenance contracts expired\" (AssetManagementMaintExpired) and \"Maintenance contracts strategy\" (AssetManagementMaintStrategy) via the reporting REST API (POST /rest/reports/{id}) and supply a DATE_FORMAT parameter that the report templates substitute literally, un-escaped, into their SQL queries. This lets an attacker execute arbitrary SQL against the OpenNMS database and read arbitrary data, including database-stored secrets such as provisioning and notification credentials and SNMP community strings.\n\n\n\nThe solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization\u0027s private networks and should not be directly accessible from the Internet."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T20:30:58.379Z",
        "orgId": "70b007e9-5235-4ee5-90b5-a71a81beeda0",
        "shortName": "OpenNMS"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenNMS/opennms/pull/8832"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "70b007e9-5235-4ee5-90b5-a71a81beeda0",
    "assignerShortName": "OpenNMS",
    "cveId": "CVE-2026-89089",
    "datePublished": "2026-09-10T20:30:58.379Z",
    "dateReserved": "2026-09-10T20:09:58.506Z",
    "dateUpdated": "2026-09-11T14:51:40.860Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89089",
      "date": "2026-09-14",
      "epss": "0.00215",
      "percentile": "0.11982"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89089\",\"sourceIdentifier\":\"security@opennms.com\",\"published\":\"2026-09-10T21:17:53.033\",\"lastModified\":\"2026-09-11T15:17:08.600\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user (ROLE_USER) can run the shipped, default-enabled online reports \\\"Maintenance contracts expired\\\" (AssetManagementMaintExpired) and \\\"Maintenance contracts strategy\\\" (AssetManagementMaintStrategy) via the reporting REST API (POST /rest/reports/{id}) and supply a DATE_FORMAT parameter that the report templates substitute literally, un-escaped, into their SQL queries. This lets an attacker execute arbitrary SQL against the OpenNMS database and read arbitrary data, including database-stored secrets such as provisioning and notification credentials and SNMP community strings.\\n\\n\\n\\nThe solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization\u0027s private networks and should not be directly accessible from the Internet.\"}],\"affected\":[{\"source\":\"security@opennms.com\",\"affectedData\":[{\"vendor\":\"The OpenNMS Group\",\"product\":\"Meridian\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://github.com/OpenNMS\",\"versions\":[{\"version\":\"2024.1.0\",\"lessThan\":\"2024.3.13\",\"versionType\":\"maven\",\"status\":\"affected\"},{\"version\":\"2025.0.0\",\"lessThan\":\"2025.0.10\",\"versionType\":\"maven\",\"status\":\"affected\"}]},{\"vendor\":\"The OpenNMS Group\",\"product\":\"Horizon\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://github.com/OpenNMS\",\"versions\":[{\"version\":\"36.0.0\",\"lessThan\":\"36.0.4\",\"versionType\":\"maven\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@opennms.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-11T14:51:29.896443Z\",\"id\":\"CVE-2026-89089\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@opennms.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-89\"}]}],\"references\":[{\"url\":\"https://github.com/OpenNMS/opennms/pull/8832\",\"source\":\"security@opennms.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-89089\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-11T14:51:29.896443Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-11T14:51:37.293Z\"}}], \"cna\": {\"title\": \"OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Xanlar Agamalizade\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/OpenNMS\", \"vendor\": \"The OpenNMS Group\", \"product\": \"Meridian\", \"versions\": [{\"status\": \"affected\", \"version\": \"2024.1.0\", \"lessThan\": \"2024.3.13\", \"versionType\": \"maven\"}, {\"status\": \"affected\", \"version\": \"2025.0.0\", \"lessThan\": \"2025.0.10\", \"versionType\": \"maven\"}], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://github.com/OpenNMS\", \"vendor\": \"The OpenNMS Group\", \"product\": \"Horizon\", \"versions\": [{\"status\": \"affected\", \"version\": \"36.0.0\", \"lessThan\": \"36.0.4\", \"versionType\": \"maven\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eUpgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer.\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://github.com/OpenNMS/opennms/pull/8832\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.4\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user (ROLE_USER) can run the shipped, default-enabled online reports \\\"Maintenance contracts expired\\\" (AssetManagementMaintExpired) and \\\"Maintenance contracts strategy\\\" (AssetManagementMaintStrategy) via the reporting REST API (POST /rest/reports/{id}) and supply a DATE_FORMAT parameter that the report templates substitute literally, un-escaped, into their SQL queries. This lets an attacker execute arbitrary SQL against the OpenNMS database and read arbitrary data, including database-stored secrets such as provisioning and notification credentials and SNMP community strings.\\n\\n\\n\\nThe solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization\u0027s private networks and should not be directly accessible from the Internet.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eA SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user (ROLE_USER) can run the shipped, default-enabled online reports \\\"Maintenance contracts expired\\\" (AssetManagementMaintExpired) and \\\"Maintenance contracts strategy\\\" (AssetManagementMaintStrategy) via the reporting REST API (POST /rest/reports/{id}) and supply a DATE_FORMAT parameter that the report templates substitute literally, un-escaped, into their SQL queries. This lets an attacker execute arbitrary SQL against the OpenNMS database and read arbitrary data, including database-stored secrets such as provisioning and notification credentials and SNMP community strings.\u003c/p\u003e\u003cp\u003eThe solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization\u0027s private networks and should not be directly accessible from the Internet.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-89\", \"description\": \"CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"70b007e9-5235-4ee5-90b5-a71a81beeda0\", \"shortName\": \"OpenNMS\", \"dateUpdated\": \"2026-09-10T20:30:58.379Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-89089\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-11T14:51:40.860Z\", \"dateReserved\": \"2026-09-10T20:09:58.506Z\", \"assignerOrgId\": \"70b007e9-5235-4ee5-90b5-a71a81beeda0\", \"datePublished\": \"2026-09-10T20:30:58.379Z\", \"assignerShortName\": \"OpenNMS\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-89089

Vulnerability from fkie_nvd - Published: 2026-09-10 21:17 - Updated: 2026-09-11 15:17

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security@opennms.com	https://github.com/OpenNMS/opennms/pull/8832

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Meridian",
          "repo": "https://github.com/OpenNMS",
          "vendor": "The OpenNMS Group",
          "versions": [
            {
              "lessThan": "2024.3.13",
              "status": "affected",
              "version": "2024.1.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2025.0.10",
              "status": "affected",
              "version": "2025.0.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Horizon",
          "repo": "https://github.com/OpenNMS",
          "vendor": "The OpenNMS Group",
          "versions": [
            {
              "lessThan": "36.0.4",
              "status": "affected",
              "version": "36.0.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "source": "security@opennms.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user (ROLE_USER) can run the shipped, default-enabled online reports \"Maintenance contracts expired\" (AssetManagementMaintExpired) and \"Maintenance contracts strategy\" (AssetManagementMaintStrategy) via the reporting REST API (POST /rest/reports/{id}) and supply a DATE_FORMAT parameter that the report templates substitute literally, un-escaped, into their SQL queries. This lets an attacker execute arbitrary SQL against the OpenNMS database and read arbitrary data, including database-stored secrets such as provisioning and notification credentials and SNMP community strings.\n\n\n\nThe solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization\u0027s private networks and should not be directly accessible from the Internet."
    }
  ],
  "id": "CVE-2026-89089",
  "lastModified": "2026-09-11T15:17:08.600",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security@opennms.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-89089",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-11T14:51:29.896443Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-10T21:17:53.033",
  "references": [
    {
      "source": "security@opennms.com",
      "url": "https://github.com/OpenNMS/opennms/pull/8832"
    }
  ],
  "sourceIdentifier": "security@opennms.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "security@opennms.com",
      "type": "Secondary"
    }
  ]
}

GHSA-FCJX-6CV6-5WQJ

Vulnerability from github – Published: 2026-09-10 21:31 – Updated: 2026-09-10 21:31

Details

The solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-89089"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-10T21:17:53Z",
    "severity": "MODERATE"
  },
  "details": "A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user (ROLE_USER) can run the shipped, default-enabled online reports \"Maintenance contracts expired\" (AssetManagementMaintExpired) and \"Maintenance contracts strategy\" (AssetManagementMaintStrategy) via the reporting REST API (POST /rest/reports/{id}) and supply a DATE_FORMAT parameter that the report templates substitute literally, un-escaped, into their SQL queries. This lets an attacker execute arbitrary SQL against the OpenNMS database and read arbitrary data, including database-stored secrets such as provisioning and notification credentials and SNMP community strings.\n\n\n\nThe solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization\u0027s private networks and should not be directly accessible from the Internet.",
  "id": "GHSA-fcjx-6cv6-5wqj",
  "modified": "2026-09-10T21:31:38Z",
  "published": "2026-09-10T21:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89089"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenNMS/opennms/pull/8832"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-89089 (GCVE-0-2026-89089)

FKIE_CVE-2026-89089

GHSA-FCJX-6CV6-5WQJ

Tags

Sightings

Nomenclature