CVE-2026-89089— OpenNMS 资产模块SQL注入漏洞
一分钟漏洞结论
影响对象
The OpenNMS Group Meridian
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
OpenNMS Meridian 和 Horizon 的多个版本中，基于 JasperReports 的报告功能存在 SQL 注入漏洞。一个低权限的已认证用户（ROLE_USER）可以通过报告 REST API（POST /rest/reports/{id}）运行系统默认启用且预置的在线报告“维护合同已过期”（AssetManagementMaintExpired）和“维护合同策略”（AssetManagementMaintStrategy）。攻击者可以提供一个 DATE_FORMAT 参数，而报告模板会将其原样、
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-89089 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)
来源: CVE Program / CVE List V5
Vulnerability Description
A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user (ROLE_USER) can run the shipped, default-enabled online reports "Maintenance contracts expired" (AssetManagementMaintExpired) and "Maintenance contracts strategy" (AssetManagementMaintStrategy) via the reporting REST API (POST /rest/reports/{id}) and supply a DATE_FORMAT parameter that the report templates substitute literally, un-escaped, into their SQL queries. This lets an attacker execute arbitrary SQL against the OpenNMS database and read arbitrary data, including database-stored secrets such as provisioning and notification credentials and SNMP community strings.
The solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| The OpenNMS Group | Meridian | 2024.1.0 ~ 2024.3.13 | - |
|
| The OpenNMS Group | Horizon | 36.0.0 ~ 36.0.4 | - |
|
二、漏洞 CVE-2026-89089 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-89089 的情报信息
请登录查看更多情报信息。
CVE-2026-89089 补丁与修复 (1)
同批安全公告 · The OpenNMS Group · 2026-09-10 · 共 3 条
| CVE-2026-89054 | 8.2 HIGH | OpenNMS /api/v2补丁接口未授权配置修改漏洞 |
| CVE-2026-19596 | 5.9 MEDIUM | OpenNMS 采集器 XML 实体注入漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-89089
暂无评论