OpenNMS Meridian CVE-2026-111235

Exploitation requires only network reachability to the OpenNMS /rest/** REST API and the ability to send an HTTP request using a non-canonical method token (for example a lowercase verb such as 'get' or 'put' instead of 'GET'/'PUT'); no authentication, credentials, or user interaction are needed, and all pre-fix versions in default configuration are affected. The primary factor LIMITING exploitation is deployment posture: the vendor states Meridian/Horizon are intended for private networks and should not be directly Internet-accessible, so in correctly segmented environments the attacker must first reach the internal management network. The alarm-existence disclosure specifically relies on observing a difference in the /rest/alarms response.

This is a genuinely high-priority flaw where the CVSS signal and the technical reality agree: the vendor-supplied vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N → C:H/I:H) describes a remote, unauthenticated, low-complexity authorization bypass, and the source diff (PR #8934) confirms the exact mechanism - Spring Security intercept-url rules match the HTTP method as a case-sensitive uppercase token with no terminal deny rule, so a lowercase method token falls through all rules and is served without authentication. Exploitation is trivial (merely altering the HTTP method verb case), which argues for treating it as critical wherever the API is reachable. The strongest mitigating signal is NOT in the scoring but in the vendor documentation: Meridian/Horizon are designed for deployment inside private networks and explicitly should not be Internet-facing, so real-world exposure depends heavily on network position - Internet-exposed or flat-network instances are at severe, trivially-exploitable risk, while correctly segmented internal instances require an attacker to already hold a network foothold. Note the gaps: no EPSS probability was provided, the CVE is NOT in CISA KEV, and no public POC was identified, so there is currently no evidence of active or widespread exploitation despite the critical score - the 9.1 reflects ease and impact, not observed in-the-wild activity.

An attacker with network access to an OpenNMS Horizon or Meridian REST API sends an otherwise normal request but uses a non-canonical (e.g. lowercase) HTTP method token, which matches none of the method-specific intercept-url rules and, because no terminal deny rule exists, is processed with no authentication. The attacker can then read the full monitored inventory and create, modify, or delete resources - including injecting events to fabricate or suppress alarms, or probing /rest/alarms to learn whether a given alarm exists from response differences. No public exploit code was identified, but the technique is trivial (AV:N/AC:L/PR:N) and requires only crafting the method verb.