CVE-2026-19182: OpenNMS Auth Bypass Vulnerability

CVE-2026-19182 Overview

CVE-2026-19182 is an incorrect authorization vulnerability [CWE-863] in the v2 Alarm REST API of OpenNMS Meridian and Horizon. A low-privileged authenticated user holding ROLE_REST can acknowledge, escalate, or clear alarms while recording the action under an arbitrary username. When the same user also holds ROLE_READONLY, they can modify alarm state despite the read-only restriction. The credential check that should block these operations is guarded by an inverted condition, so it never executes for a real non-blank username. Attackers can compromise the integrity of alarm state and audit records in network monitoring deployments.

Critical Impact
Authenticated low-privileged users can tamper with alarm state and forge audit records under arbitrary usernames, undermining incident response and monitoring integrity.

Affected Products

OpenNMS Meridian versions prior to 2024.3.12
OpenNMS Meridian versions prior to 2025.0.9
OpenNMS Horizon versions prior to 36.0.3

Discovery Timeline

2026-08-13 - CVE-2026-19182 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-19182

Vulnerability Analysis

The vulnerability resides in the v2 Alarm REST API endpoints responsible for acknowledging, escalating, and clearing alarms in OpenNMS Meridian and Horizon. These operations require validating that the authenticated caller matches the username recorded against the alarm action. The credential validation logic contains an inverted boolean condition, so the guard executes only when the supplied username is blank. Any real (non-blank) username bypasses the check entirely.

A user with only ROLE_REST can therefore submit alarm state changes attributed to any username of their choosing. When ROLE_READONLY is also assigned, the read-only enforcement that should block writes to alarm state is likewise bypassed. The result is unauthorized modification of alarm records and falsified audit trails within the fault management subsystem.

Root Cause

The root cause is a logic flaw classified as [CWE-863] Incorrect Authorization. The conditional gating the credential comparison is inverted, so the intended authorization branch is unreachable during normal API use. This design defect allows the API layer to accept alarm mutations that the underlying access model was intended to reject.

Attack Vector

Exploitation requires network access to the OpenNMS REST API and valid credentials for an account with ROLE_REST. The attacker issues authenticated HTTP requests to the v2 Alarm endpoints, supplying a non-blank arbitrary username in the acknowledgment, escalation, or clear operation. See the OpenNMS Pull Request #8755 for the corrected authorization logic.

Detection Methods for CVE-2026-19182

Indicators of Compromise

Alarm acknowledgment, escalation, or clear events attributed to usernames that do not match the authenticated session principal.
REST API calls to v2 Alarm endpoints originating from accounts provisioned with only ROLE_REST or ROLE_REST combined with ROLE_READONLY.
Discrepancies between OpenNMS audit records and expected operator workflows for alarm handling.

Detection Strategies

Review web server and application logs for POST/PUT requests against /opennms/api/v2/alarms endpoints and correlate the recorded username with the authenticating principal.
Alert on any alarm state transition performed by accounts holding ROLE_READONLY, since these should not modify state under any circumstance.
Baseline normal alarm-handling users and flag deviations where new or service accounts begin acknowledging or clearing alarms.

Monitoring Recommendations

Forward OpenNMS application and audit logs to a centralized SIEM for retention and correlation.
Monitor authentication events for ROLE_REST accounts and track their API usage patterns over time.
Enable alerting on bulk alarm state changes, which may indicate scripted abuse of the flawed endpoint.

How to Mitigate CVE-2026-19182

Immediate Actions Required

Upgrade OpenNMS Meridian to version 2024.3.12 or 2025.0.9, or upgrade OpenNMS Horizon to version 36.0.3 or newer.
Audit user accounts assigned ROLE_REST and ROLE_READONLY and revoke privileges from accounts that do not require API access.
Review historical alarm audit records for entries recorded under unexpected usernames prior to patching.

Patch Information

The fix is included in OpenNMS Meridian 2024.3.12, Meridian 2025.0.9, and Horizon 36.0.3. The corrected authorization logic is available in the upstream OpenNMS Pull Request #8755.

Workarounds

Restrict OpenNMS Meridian and Horizon deployments to private networks, consistent with vendor installation guidance that these products should not be directly exposed to the Internet.
Place the OpenNMS REST API behind a reverse proxy or web application firewall that enforces per-user authorization on /api/v2/alarms endpoints.
Temporarily remove ROLE_REST from accounts that do not require programmatic alarm management until the upgrade is completed.

bash

# Configuration example: restrict REST API access at the reverse proxy layer
location /opennms/api/v2/alarms {
    allow 10.0.0.0/8;         # internal management network only
    deny  all;
    proxy_pass http://opennms-backend;
}