Vulnerability · Published Sep 10, 2026 · Assigned by OpenNMS
CVE-2026-19596OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host
Medium 5.9
In plain English
A medium-severity XML external entity in Horizon from The OpenNMS Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Official description
An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled (for example a compromised monitored host or an HTTP man-in-the-middle position), the collector's XML parser resolves external entities and external DTDs. This allows an attacker to read files accessible to the OpenNMS service account, including database credentials, and to induce out-of-band requests. The solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The OpenNMS Group | Meridian | 2024.1.0 – before 2024.3.132025.0.0 – before 2025.0.10 |
| The OpenNMS Group | Horizon | 36.0.0 – before 36.0.4 |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N