CVE-2026-19135: OpenNMS JEXL Sandbox Bypass RCE Flaw

CVE-2026-19135 Overview

CVE-2026-19135 is a JEXL expression sandbox bypass affecting multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API. The crafted input escapes the sandbox and loads arbitrary Java classes on the server. Successful exploitation can expose confidential information and compromise data integrity.

The issue is tracked under [CWE-470] Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection). OpenNMS resolves the flaw in Meridian 2024.3.12, Meridian 2025.0.9, and Horizon 36.0.3.

Critical Impact
Authenticated users can bypass the JEXL sandbox through the Measurements REST API to load arbitrary Java classes, enabling information disclosure and integrity compromise on OpenNMS servers.

Affected Products

OpenNMS Meridian versions prior to 2024.3.12
OpenNMS Meridian versions prior to 2025.0.9
OpenNMS Horizon versions prior to 36.0.3

Discovery Timeline

2026-08-13 - CVE-2026-19135 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-19135

Vulnerability Analysis

OpenNMS uses the Java Expression Language (JEXL) to evaluate user-supplied expressions inside the Measurements REST API. The API applies a sandbox that restricts which classes and methods callers can reference. The sandbox implementation fails to fully constrain class resolution.

An authenticated attacker with low privileges crafts an expression that leverages reflection primitives reachable from the JEXL context. The expression escapes the sandbox and instructs the Java Virtual Machine to load classes that were never intended to be reachable from the API. Once arbitrary classes load, the attacker can read sensitive server-side data and manipulate application state.

The vendor documentation states that Meridian and Horizon are designed for deployment inside private networks and should not be exposed to the public Internet. Internet-facing deployments materially increase exposure.

Root Cause

The root cause is an incomplete allowlist in the JEXL sandbox. The evaluator permits expression constructs that reach java.lang.Class and related reflective APIs. This aligns with [CWE-470], where externally controlled input selects the classes or code that the runtime loads.

Attack Vector

Exploitation requires network access to the Measurements REST API and valid credentials for any account with permission to submit measurement expressions. The attacker sends an HTTP request containing a JEXL payload that resolves a restricted class through reflection. The server evaluates the expression and returns data or side effects controlled by the attacker. No user interaction is required.

A proof of concept is not publicly published. Technical remediation details are visible in the upstream fix at OpenNMS Pull Request 8754.

Detection Methods for CVE-2026-19135

Indicators of Compromise

HTTP requests to the Measurements REST API endpoint containing JEXL expressions that reference class, forName, getClass, or ClassLoader tokens.
Unexpected Java class-loading events on OpenNMS hosts originating from the Measurements API request thread.
Authentication events for low-privilege accounts followed immediately by anomalous Measurements API traffic.

Detection Strategies

Inspect application access logs for POST or GET requests to /opennms/rest/measurements carrying expression payloads with reflective keywords.
Correlate authenticated API sessions with outbound network activity or file access from the OpenNMS process to surface post-exploitation behavior.
Baseline normal JEXL expressions used by dashboards, then alert on deviations that include reflection or classloader lookups.

Monitoring Recommendations

Enable verbose logging on the Measurements API and forward events to a centralized log platform for retention and query.
Monitor the OpenNMS JVM for unexpected child processes, filesystem writes outside install directories, and new outbound connections.
Track authentication events for service and low-privilege accounts that historically do not call the Measurements API.

How to Mitigate CVE-2026-19135

Immediate Actions Required

Upgrade OpenNMS Meridian to 2024.3.12, Meridian 2025.0.9, or Horizon 36.0.3 or newer as published by OpenNMS.
Restrict network reachability to the Measurements REST API so that only trusted internal management hosts can connect.
Audit user accounts with access to the Measurements API and remove unnecessary privileges.

Patch Information

OpenNMS resolved the sandbox bypass in Meridian 2024.3.12, Meridian 2025.0.9, and Horizon 36.0.3. The upstream code change is available in OpenNMS Pull Request 8754. Administrators should verify the running version after upgrade and confirm the Measurements API rejects reflective expressions.

Workarounds

Confirm the OpenNMS instance is not reachable from the public Internet, consistent with vendor deployment guidance.
Place OpenNMS behind a reverse proxy or web application firewall that blocks expression payloads containing reflection keywords.
Rotate credentials for any account that could reach the Measurements API prior to patching.

bash

# Example: block reflective JEXL payloads at a reverse proxy (nginx)
location /opennms/rest/measurements {
    if ($request_body ~* "(getClass|forName|ClassLoader|Runtime|ProcessBuilder)") {
        return 403;
    }
    proxy_pass http://opennms_backend;
}