CVE-2026-89017 · Other
NO FIX YET · SEE WHAT TO DO
Skyline DataMiner's BrokerGateway contains an embedded API key that unauthenticated attackers can retrieve, even when pairing mode is disabled. The retrieved key yields an unrestricted NATS credential, giving attackers trusted access to the message bus on TCP port 4222 without any DataMiner login.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running Skyline DataMiner with the BrokerGateway component are exposed. The sources do not say whether exposure requires a specific network configuration, so check whether the NATS port is reachable beyond trusted hosts.
Not affected if fixed-version
Who cares brokergateway, industrial-iot, nats, skyline-dataminer
4222 on DataMiner BrokerGateway hosts is reachable from untrusted networks.10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, or 10.4.0 CU22, matching your release line.Skyline DataMiner BrokerGateway contains an embedded API key vulnerability that allows unauthenticated attackers to retrieve the installation-specific BrokerGateway key even while pairing mode is disabled. Attackers can use the retrieved key to obtain the unrestricted DataMinerUser.creds NATS credential and gain trusted message-bus access via TCP port 4222 without any prior DataMiner credentials. Fixed in DataMiner 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, and 10.4.0 CU22.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.