CVE-2026-89054

CVE-2026-89054 is a missing authorization flaw (CWE-862) in OpenNMS Horizon: the Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, leaving the shipped @PATCH configuration endpoints for event configuration and SNMP data collection reachable with no authentication enforced. An unauthenticated attacker who can reach the web UI can send PATCH requests to disable event definitions and SNMP data-collection sources, with the change persisted and reloaded into the running system. The attacker gains suppression of event and alarm generation and cessation of metric collection, silently degrading monitoring and detection with no confidentiality impact (CVSS 3.1: 8.2, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L). All OpenNMS Horizon deployments running versions before 36.0.4 are affected; vendor documentation states Horizon and Meridian are intended for private networks and not direct Internet access, so exploitation most plausibly comes from attackers with internal network reach to the web UI or misconfigured Internet-exposed instances. No public proof-of-concept is known, the issue is not in the CISA KEV catalog, and no exploitation has been reported.

What to do: Upgrade to OpenNMS Horizon 36.0.4 or newer. Until patched, restrict network access to the Horizon web UI and /api/v2 REST endpoints (firewall/ACL rules or reverse-proxy authentication), consistent with vendor guidance that the product not be directly Internet-accessible. Review event configuration and SNMP data-collection settings for unauthorized changes and verify that event/alarm generation and metric collection have not been silently disabled.