CVE-2026-19135

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-19135
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19135.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-19135
Downstream
Published
2026-08-13T04:47:25.584Z
Modified
2026-08-19T09:06:15.614201Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classes
Details

A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an attacker to gain access to confidential information and compromise integrity.

The solution is to upgrade to Meridian 2024.3.12, 2025.0.9 and Horizon 36.0.3 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Database specific 
{
    "cna_assigner": "OpenNMS",
    "cwe_ids": [
        "CWE-470"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19135.json"
}
References

Affected packages

Git / github.com/opennms/opennms

Affected ranges

Type
GIT
Repo
https://github.com/opennms/opennms
Events
Introduced
7305020f29cda2d1bf0e55331828f39d572877ed
Fixed
3ad55bddc49fc2b0514d888637202c81e0c645db
Introduced
96a924a0abc85d09fa27264cd8728818c90ef8cc
Fixed
8c8564911a9bdb88ad38102db893b4cc7bcab90b
Introduced
19be3a5ddc789e5f5a58fa58b965544559f3446b
Fixed
e05049c7ec4f16166f1294a7ff6afc3c50473cc6
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2024.1.0"
        },
        {
            "fixed": "2024.3.12"
        },
        {
            "introduced": "2025.0.0"
        },
        {
            "fixed": "2025.0.9"
        },
        {
            "introduced": "36.0.0"
        },
        {
            "fixed": "36.0.3"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

meridian-foundation-2024.*
meridian-foundation-2024.3.10-1
meridian-foundation-2024.3.11-1
meridian-foundation-2024.3.3-1
meridian-foundation-2024.3.4-1
meridian-foundation-2024.3.5-1
meridian-foundation-2024.3.6-1
meridian-foundation-2024.3.7-1
meridian-foundation-2024.3.8-1
meridian-foundation-2024.3.9-1
meridian-foundation-2025.*
meridian-foundation-2025.0.0-1
opennms-36.*
opennms-36.0.0-1
opennms-36.0.1-1
opennms-36.0.2-1

Database specific

vanir_signatures_modified 
"2026-08-19T09:06:15Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19135.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "target": {
            "function": "getFrameworkUrl",
            "file": "opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java"
        },
        "signature_type": "Function",
        "source": "https://github.com/opennms/opennms/commit/e05049c7ec4f16166f1294a7ff6afc3c50473cc6",
        "digest": {
            "length": 185.0,
            "function_hash": "331435796803778688470922217781350364006"
        },
        "signature_version": "v1",
        "id": "CVE-2026-19135-3527a5ac"
    },
    {
        "deprecated": false,
        "target": {
            "file": "opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java"
        },
        "signature_type": "Line",
        "source": "https://github.com/opennms/opennms/commit/e05049c7ec4f16166f1294a7ff6afc3c50473cc6",
        "digest": {
            "line_hashes": [
                "94799603691170027326530205386552830356",
                "224936643222389091944396133222883451304",
                "23265830325524696713009665235577633370",
                "246719522281239684007795993110967870987"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "id": "CVE-2026-19135-4fb7dc9f"
    }
]