{"id":"CVE-2026-19596","summary":"OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host","details":"An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled (for example a compromised monitored host or an HTTP man-in-the-middle position), the collector's XML parser resolves external entities and external DTDs. This allows an attacker to read files accessible to the OpenNMS service account, including database credentials, and to induce out-of-band requests.\n\n\n\nThe solution is to upgrade to Meridian 2024.3.13, 2025.0.10 and Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.","modified":"2026-09-15T08:05:12.924234Z","published":"2026-09-10T20:08:50.816Z","database_specific":{"cna_assigner":"OpenNMS","cwe_ids":["CWE-611"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19596.json"},"references":[{"type":"WEB","url":"https://github.com/OpenNMS"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19596.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19596"},{"type":"FIX","url":"https://github.com/OpenNMS/opennms/pull/8782"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/opennms/opennms","events":[{"introduced":"7305020f29cda2d1bf0e55331828f39d572877ed"},{"fixed":"c04063735ea36041156c17d516c6dde356d0b897"},{"introduced":"96a924a0abc85d09fa27264cd8728818c90ef8cc"},{"fixed":"87695af1e7a0df05e6b2dc8b49d30767546b55ec"},{"introduced":"19be3a5ddc789e5f5a58fa58b965544559f3446b"},{"fixed":"f9f84926d8fff42a9ba820d9089c316203ec1002"}],"database_specific":{"extracted_events":[{"introduced":"2024.1.0"},{"fixed":"2024.3.13"},{"introduced":"2025.0.0"},{"fixed":"2025.0.10"},{"introduced":"36.0.0"},{"fixed":"36.0.4"}],"source":"AFFECTED_FIELD"}}],"versions":["opennms-36.0.3-1","meridian-foundation-2024.3.12-1","opennms-36.0.2-1","meridian-foundation-2024.3.11-1","opennms-36.0.1-1","meridian-foundation-2024.3.10-1","opennms-36.0.0-1","meridian-foundation-2024.3.9-1","meridian-foundation-2024.3.8-1","meridian-foundation-2024.3.7-1","meridian-foundation-2024.3.6-1","meridian-foundation-2024.3.5-1","meridian-foundation-2024.3.4-1","meridian-foundation-2025.0.0-1","meridian-foundation-2024.3.3-1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19596.json","vanir_signatures_modified":"2026-09-15T08:05:12Z","vanir_signatures":[{"deprecated":false,"digest":{"length":1589,"function_hash":"221103751260903223826375627537420535264"},"id":"CVE-2026-19596-02fcd9aa","signature_type":"Function","signature_version":"v1","source":"https://github.com/opennms/opennms/commit/f9f84926d8fff42a9ba820d9089c316203ec1002","target":{"file":"opennms-webapp-rest/src/main/java/org/opennms/web/rest/v2/MinionRestService.java","function":"updateProperties"}},{"id":"CVE-2026-19596-04f857e7","signature_type":"Line","signature_version":"v1","source":"https://github.com/opennms/opennms/commit/c04063735ea36041156c17d516c6dde356d0b897","target":{"file":"protocols/xml/src/main/java/org/opennms/protocols/json/collector/AbstractJsonCollectionHandler.java"},"deprecated":false,"digest":{"line_hashes":["16708839318967165819671393906244478127","184210040228807432474651400777842496589","83901528313180098450096889769767107890","241414276643304598027506225412676510677","16786943476838249877214512670581475314","272395757645972815542714462656411939656","58409543296310433776960930186509864889","308468889404651779134613722840865750325","235694110298549527541479793951066993283","144179254585104543779003807500356666018","207118955714176987077251714009058297721","313836594079100206215335127898076116340","229622763595182984725017724733359437394","3762187069596836355846382741121694236","146914958262393106961811489769731619923","71192356664315850763912341141894699213","160615191117578690281795658165627693561","15255216134759241290666678913697283980","147993016364751513780283524583409601984","311493136822784236155490955725161257997","148926936306290692752626644310339825742","18189763549634094785204548889567465839","234514892567537156861896501098702807714","96022708721989787810214319893818957136","156468822782180195508042018510475342787","101453889585699797599780773840710350495"],"threshold":0.9}},{"target":{"file":"protocols/xml/src/main/java/org/opennms/protocols/json/collector/AbstractJsonCollectionHandler.java","function":"fillCollectionSet"},"deprecated":false,"digest":{"function_hash":"256396241729339735722854218881742445846","length":1289},"id":"CVE-2026-19596-1c4ae106","signature_type":"Function","signature_version":"v1","source":"https://github.com/opennms/opennms/commit/c04063735ea36041156c17d516c6dde356d0b897"},{"deprecated":false,"digest":{"line_hashes":["142135674681907547798498035091672065130","37762487280390289375652760356513180229","193057616884681633909131678924150009094"],"threshold":0.9},"id":"CVE-2026-19596-4858f031","signature_type":"Line","signature_version":"v1","source":"https://github.com/opennms/opennms/commit/f9f84926d8fff42a9ba820d9089c316203ec1002","target":{"file":"opennms-webapp-rest/src/main/java/org/opennms/web/rest/v2/MenuRestService.java"}},{"deprecated":false,"digest":{"function_hash":"185540719963604071854790714929723400282","length":690},"id":"CVE-2026-19596-4c0a73f5","signature_type":"Function","signature_version":"v1","source":"https://github.com/opennms/opennms/commit/c04063735ea36041156c17d516c6dde356d0b897","target":{"file":"protocols/xml/src/main/java/org/opennms/protocols/json/collector/AbstractJsonCollectionHandler.java","function":"getTimeStamp"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["339053918024145401159227431694692996206","42740281208069430365725745877327366642","12497797595583790516419184372178022370","283594225014192599788585855421598123602"]},"id":"CVE-2026-19596-650c7d80","signature_type":"Line","signature_version":"v1","source":"https://github.com/opennms/opennms/commit/f9f84926d8fff42a9ba820d9089c316203ec1002","target":{"file":"opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/opennms/opennms/commit/f9f84926d8fff42a9ba820d9089c316203ec1002","target":{"file":"opennms-webapp-rest/src/main/java/org/opennms/web/rest/v1/InfoRestService.java"},"deprecated":false,"digest":{"line_hashes":["14308986018653241252234639075372215036","46397526186244193393845948109649811179","200115398857130538036097722761251305190"],"threshold":0.9},"id":"CVE-2026-19596-bc1246ef"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/opennms/opennms/commit/f9f84926d8fff42a9ba820d9089c316203ec1002","target":{"file":"opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java","function":"getFrameworkUrl"},"deprecated":false,"digest":{"function_hash":"127414735985447784269522052218874809792","length":185},"id":"CVE-2026-19596-ced9a32a"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/opennms/opennms/commit/f9f84926d8fff42a9ba820d9089c316203ec1002","target":{"file":"opennms-webapp-rest/src/main/java/org/opennms/web/rest/v2/MinionRestService.java"},"deprecated":false,"digest":{"line_hashes":["17727473870234435980273683846597052580","217986863755583739080384066962505605451","45302797195706751685133574248532255933","20805645872396559829596782147596131236","108576999932903005486262638128498081247","6361577246064848766997021916569747756","225081703112538110023774791148663775675","134000701704222640599749202018219039232","31282447263955929947501303910372997362","279636379433884110899736694475674407174","60789912806618773689919632314678599926","231049956602237962616352405443643933229","91373827335538607238788091371589821940","24485933306970051953558917308357881463","172663675147689218254356944368196165173"],"threshold":0.9},"id":"CVE-2026-19596-d974659e"},{"deprecated":false,"digest":{"function_hash":"280206283098929094172402912666630482930","length":604},"id":"CVE-2026-19596-faa96689","signature_type":"Function","signature_version":"v1","source":"https://github.com/opennms/opennms/commit/c04063735ea36041156c17d516c6dde356d0b897","target":{"file":"protocols/xml/src/main/java/org/opennms/protocols/json/collector/AbstractJsonCollectionHandler.java","function":"getResourceName"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}