Vulnerability-Lookup

ubuntu-cve-2026-19135

Vulnerability from osv_ubuntu

Published

2026-08-13 00:00

Modified

2026-08-13 00:00

Summary

Details

A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an attacker to gain access to confidential information and compromise integrity. The solution is to upgrade to Meridian 2024.3.12, 2025.0.9 and Horizon 36.0.3 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Severity

5.4 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-19135	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-19135	REPORT
	https://github.com/OpenNMS/opennms/pull/8754	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "openstack-dashboard",
            "binary_version": "2:9.1.2-0ubuntu5.2"
          },
          {
            "binary_name": "openstack-dashboard-ubuntu-theme",
            "binary_version": "2:9.1.2-0ubuntu5.2"
          },
          {
            "binary_name": "python-django-horizon",
            "binary_version": "2:9.1.2-0ubuntu5.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "horizon",
        "purl": "pkg:deb/ubuntu/horizon@2:9.1.2-0ubuntu5.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2:8.0.0-0ubuntu2",
        "2:9.0.0~b1-0ubuntu1",
        "2:9.0.0~b1-0ubuntu2",
        "2:9.0.0~b2-0ubuntu1",
        "2:9.0.0~b3-0ubuntu1",
        "2:9.0.0~rc1-0ubuntu1",
        "2:9.0.0-0ubuntu1",
        "2:9.0.0-0ubuntu2",
        "2:9.0.0-0ubuntu2.16.04.1",
        "2:9.0.1-0ubuntu2",
        "2:9.1.0-0ubuntu1",
        "2:9.1.1-0ubuntu1",
        "2:9.1.2-0ubuntu1",
        "2:9.1.2-0ubuntu2",
        "2:9.1.2-0ubuntu3",
        "2:9.1.2-0ubuntu5",
        "2:9.1.2-0ubuntu5.2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "openstack-dashboard",
            "binary_version": "3:13.0.3-0ubuntu2"
          },
          {
            "binary_name": "openstack-dashboard-ubuntu-theme",
            "binary_version": "3:13.0.3-0ubuntu2"
          },
          {
            "binary_name": "python-django-horizon",
            "binary_version": "3:13.0.3-0ubuntu2"
          },
          {
            "binary_name": "python-django-openstack-auth",
            "binary_version": "3:13.0.3-0ubuntu2"
          },
          {
            "binary_name": "python3-django-openstack-auth",
            "binary_version": "3:13.0.3-0ubuntu2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "horizon",
        "purl": "pkg:deb/ubuntu/horizon@3:13.0.3-0ubuntu2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3:12.0.0-0ubuntu2.1",
        "3:12.0.0-0ubuntu3",
        "3:13.0.0~b1-0ubuntu1",
        "3:13.0.0~b1-0ubuntu2",
        "3:13.0.0-0ubuntu1",
        "3:13.0.0-0ubuntu1.1",
        "3:13.0.1-0ubuntu1",
        "3:13.0.1-0ubuntu2",
        "3:13.0.1-0ubuntu3",
        "3:13.0.1-0ubuntu4",
        "3:13.0.1-0ubuntu5",
        "3:13.0.1-0ubuntu6",
        "3:13.0.2-0ubuntu1",
        "3:13.0.2-0ubuntu2",
        "3:13.0.2-0ubuntu3",
        "3:13.0.3-0ubuntu1",
        "3:13.0.3-0ubuntu2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "openstack-dashboard",
            "binary_version": "3:18.3.5-0ubuntu2.3+esm1"
          },
          {
            "binary_name": "openstack-dashboard-common",
            "binary_version": "3:18.3.5-0ubuntu2.3+esm1"
          },
          {
            "binary_name": "openstack-dashboard-ubuntu-theme",
            "binary_version": "3:18.3.5-0ubuntu2.3+esm1"
          },
          {
            "binary_name": "python3-django-horizon",
            "binary_version": "3:18.3.5-0ubuntu2.3+esm1"
          },
          {
            "binary_name": "python3-django-openstack-auth",
            "binary_version": "3:18.3.5-0ubuntu2.3+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "horizon",
        "purl": "pkg:deb/ubuntu/horizon@3:18.3.5-0ubuntu2.3+esm1?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3:16.0.0-0ubuntu1",
        "3:17.0.0~b1~git2019121712.f7313b74c-0ubuntu1",
        "3:18.0.1~git2020021409.bb959361b-0ubuntu2",
        "3:18.0.1~git2020021409.bb959361b-0ubuntu3",
        "3:18.2.1~git2020032709.2c4470272-0ubuntu1",
        "3:18.2.1~git2020041013.754804667-0ubuntu1",
        "3:18.2.1~git2020041013.754804667-0ubuntu2",
        "3:18.2.1~git2020041013.754804667-0ubuntu3",
        "3:18.3.2-0ubuntu0.20.04.1",
        "3:18.3.2-0ubuntu0.20.04.2",
        "3:18.3.2-0ubuntu0.20.04.4",
        "3:18.3.3-0ubuntu1",
        "3:18.3.4-0ubuntu1",
        "3:18.3.5-0ubuntu1",
        "3:18.3.5-0ubuntu2",
        "3:18.3.5-0ubuntu2.1",
        "3:18.3.5-0ubuntu2.2",
        "3:18.3.5-0ubuntu2.3",
        "3:18.3.5-0ubuntu2.3+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "openstack-dashboard",
            "binary_version": "4:22.1.1-0ubuntu1.1"
          },
          {
            "binary_name": "openstack-dashboard-common",
            "binary_version": "4:22.1.1-0ubuntu1.1"
          },
          {
            "binary_name": "openstack-dashboard-ubuntu-theme",
            "binary_version": "4:22.1.1-0ubuntu1.1"
          },
          {
            "binary_name": "python3-django-horizon",
            "binary_version": "4:22.1.1-0ubuntu1.1"
          },
          {
            "binary_name": "python3-django-openstack-auth",
            "binary_version": "4:22.1.1-0ubuntu1.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "horizon",
        "purl": "pkg:deb/ubuntu/horizon@4:22.1.1-0ubuntu1.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4:20.1.0-0ubuntu1",
        "4:20.2.0+git2021120911.fc1012628-0ubuntu1",
        "4:20.2.0+git2022011216.8fe5bbc8d-0ubuntu1",
        "4:21.0.0+git2022030313.dd9e4c82b-0ubuntu2",
        "4:22.1.0-0ubuntu1",
        "4:22.1.0-0ubuntu2",
        "4:22.1.0-0ubuntu2.1",
        "4:22.1.1-0ubuntu1",
        "4:22.1.1-0ubuntu1.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "openstack-dashboard",
            "binary_version": "4:24.0.1-0ubuntu0.24.04.2"
          },
          {
            "binary_name": "openstack-dashboard-common",
            "binary_version": "4:24.0.1-0ubuntu0.24.04.2"
          },
          {
            "binary_name": "openstack-dashboard-ubuntu-theme",
            "binary_version": "4:24.0.1-0ubuntu0.24.04.2"
          },
          {
            "binary_name": "python3-django-horizon",
            "binary_version": "4:24.0.1-0ubuntu0.24.04.2"
          },
          {
            "binary_name": "python3-django-openstack-auth",
            "binary_version": "4:24.0.1-0ubuntu0.24.04.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "horizon",
        "purl": "pkg:deb/ubuntu/horizon@4:24.0.1-0ubuntu0.24.04.2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4:23.3.0-0ubuntu1",
        "4:23.3.0-0ubuntu2",
        "4:23.4.0+git2024011916.a77818d7-0ubuntu1",
        "4:24.0.0-0ubuntu1",
        "4:24.0.0-0ubuntu1.1",
        "4:24.0.0-0ubuntu1.2",
        "4:24.0.0-0ubuntu1.3",
        "4:24.0.1-0ubuntu0.24.04.1",
        "4:24.0.1-0ubuntu0.24.04.2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "openstack-dashboard",
            "binary_version": "4:25.7.1-0ubuntu1"
          },
          {
            "binary_name": "openstack-dashboard-common",
            "binary_version": "4:25.7.1-0ubuntu1"
          },
          {
            "binary_name": "openstack-dashboard-ubuntu-theme",
            "binary_version": "4:25.7.1-0ubuntu1"
          },
          {
            "binary_name": "python3-django-horizon",
            "binary_version": "4:25.7.1-0ubuntu1"
          },
          {
            "binary_name": "python3-django-openstack-auth",
            "binary_version": "4:25.7.1-0ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "horizon",
        "purl": "pkg:deb/ubuntu/horizon@4:25.7.1-0ubuntu1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4:25.5.1-0ubuntu1",
        "4:25.5.1-0ubuntu2",
        "4:25.5.1+git2026012819.479212220-0ubuntu1",
        "4:25.7.1-0ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an attacker to gain access to confidential information and compromise integrity. The solution is to upgrade to Meridian 2024.3.12, 2025.0.9 and Horizon 36.0.3 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization\u0027s private networks and should not be directly accessible from the Internet.",
  "id": "UBUNTU-CVE-2026-19135",
  "modified": "2026-08-13T00:00:00Z",
  "published": "2026-08-13T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-19135"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19135"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/OpenNMS/opennms/pull/8754"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-19135"
  ]
}

CVE-2026-19135 (GCVE-0-2026-19135)

Vulnerability from cvelistv5 – Published: 2026-08-13 04:47 – Updated: 2026-08-13 13:02

Title

OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classes

Summary

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 13:02 UTC

CWE

CWE-470 - Use of Externally-Controlled input to select classes or code ('unsafe reflection')

Assigner

OpenNMS

References

1 reference

URL	Tags
https://github.com/OpenNMS/opennms/pull/8754

Impacted products

2 products

Vendor	Product	Version
The OpenNMS Group	Meridian	Affected: 2024.1.0 , < 2024.3.12 (maven) Affected: 2025.0.0 , < 2025.0.9 (maven)
The OpenNMS Group	Horizon	Affected: 36.0.0 , < 36.0.3 (maven)

Credits

tinyb0y Xanlar Agamalizade

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19135",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T13:02:12.787202Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T13:02:21.227Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Meridian",
          "repo": "https://github.com/OpenNMS",
          "vendor": "The OpenNMS Group",
          "versions": [
            {
              "lessThan": "2024.3.12",
              "status": "affected",
              "version": "2024.1.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2025.0.9",
              "status": "affected",
              "version": "2025.0.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Horizon",
          "repo": "https://github.com/OpenNMS",
          "vendor": "The OpenNMS Group",
          "versions": [
            {
              "lessThan": "36.0.3",
              "status": "affected",
              "version": "36.0.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "tinyb0y"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Xanlar Agamalizade"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an attacker to gain access to confidential information and compromise integrity.\u003cbr\u003e\u003cbr\u003eThe solution is to upgrade to Meridian 2024.3.12, 2025.0.9 and Horizon 36.0.3 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization\u0027s private networks and should not be directly accessible from the Internet.\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e"
            }
          ],
          "value": "A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an attacker to gain access to confidential information and compromise integrity.\n\nThe solution is to upgrade to Meridian 2024.3.12, 2025.0.9 and Horizon 36.0.3 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization\u0027s private networks and should not be directly accessible from the Internet."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-470",
              "description": "CWE-470 Use of Externally-Controlled input to select classes or code (\u0027unsafe reflection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T04:47:25.584Z",
        "orgId": "70b007e9-5235-4ee5-90b5-a71a81beeda0",
        "shortName": "OpenNMS"
      },
      "references": [
        {
          "url": "https://github.com/OpenNMS/opennms/pull/8754"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade to Meridian 2024.3.12, 2025.0.9 and Horizon 36.0.3 or newer."
            }
          ],
          "value": "Upgrade to Meridian 2024.3.12, 2025.0.9 and Horizon 36.0.3 or newer."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classes",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "70b007e9-5235-4ee5-90b5-a71a81beeda0",
    "assignerShortName": "OpenNMS",
    "cveId": "CVE-2026-19135",
    "datePublished": "2026-08-13T04:47:25.584Z",
    "dateReserved": "2026-08-06T16:14:32.586Z",
    "dateUpdated": "2026-08-13T13:02:21.227Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

ubuntu-cve-2026-19135

Vulnerability from osv_ubuntu

CVE-2026-19135 (GCVE-0-2026-19135)

Tags

Sightings

Nomenclature