CVE-2026-89292

CriticalCVSS 9.2

Published: 03/11/2026(UTC)Translated: 03/11/2026(UTC)NVD NIST

Summary

In Eclipse Mnestix Browser versions 1.6.0 up to but excluding 2.3.0, an unauthenticated attacker could exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.

Risk Assessment

Leakage of the backend API key enables unauthorized access to all configured infrastructures and may lead to further system compromise.

Recommendation

Update Eclipse Mnestix Browser to version 2.3.0 or later and revoke and regenerate the MNESTIX_BACKEND_API_KEY.

Other vulnerabilities in Eclipse Mnestix Browser

CVE-2026-89293High
In Eclipse Mnestix Browser versions 1.2.0 up to but excluding 2.3.0, an unauthenticated attacker could perform actions only allowed to an authorized Mnestix user, such as changing Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.

Original NVD description (English source)

In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS