{"id":"CVE-2026-89017","kind":"vulnerability","aliases":["CVE-2026-89017"],"related":[],"title":"Skyline DataMiner: unauthenticated attackers obtain message-bus credentials via BrokerGateway key","description":"Skyline DataMiner BrokerGateway contains an embedded API key vulnerability that allows unauthenticated attackers to retrieve the installation-specific BrokerGateway key even while pairing mode is disabled. Attackers can use the retrieved key to obtain the unrestricted DataMinerUser.creds NATS credential and gain trusted message-bus access via TCP port 4222 without any prior DataMiner credentials. Fixed in DataMiner 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, and 10.4.0 CU22.","summary":"Skyline DataMiner's BrokerGateway contains an embedded API key that unauthenticated attackers can retrieve, even when pairing mode is disabled. The retrieved key yields an unrestricted NATS credential, giving attackers trusted access to the message bus on TCP port 4222 without any DataMiner login.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["brokergateway","industrial-iot","nats","other","skyline-dataminer"],"not_affected_if":["fixed-version"],"how_to_check":"- Check the installed DataMiner version against the fixed releases listed in the sources.\n- Confirm whether TCP port `4222` on DataMiner BrokerGateway hosts is reachable from untrusted networks.","fix":"- Upgrade DataMiner to `10.6.9 CU1`, `10.6.0 CU7`, `10.5.0 CU19`, or `10.4.0 CU22`, matching your release line.","status":"open","published_at":"2026-11-06T18:18:22+00:00","first_seen_at":"2026-11-06T18:44:09+00:00","triaged_at":"2026-11-06T18:45:13+00:00","updated_at":"2026-11-06T18:45:13+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T18:45:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade DataMiner to `10.6.9 CU1`, `10.6.0 CU7`, `10.5.0 CU19`, or `10.4.0 CU22`, matching your release line.","reach":"network","title":"Skyline DataMiner: unauthenticated attackers obtain message-bus credentials via BrokerGateway key","impact":"high","summary":"Skyline DataMiner's BrokerGateway contains an embedded API key that unauthenticated attackers can retrieve, even when pairing mode is disabled. The retrieved key yields an unrestricted NATS credential, giving attackers trusted access to the message bus on TCP port 4222 without any DataMiner login.","audience":"businesses","category":"other","nicknames":[],"who_cares":["skyline-dataminer","brokergateway","nats","industrial-iot"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker gets trusted message-bus access without any DataMiner credentials","analyst_note":"Confirm the affected version ranges and whether port 4222 is exposed by default, using the NVD entry and the VulnCheck advisory.","how_to_check":"- Check the installed DataMiner version against the fixed releases listed in the sources.\n- Confirm whether TCP port `4222` on DataMiner BrokerGateway hosts is reachable from untrusted networks.\n- unknown for other checks: the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version"],"who_is_affected":"Organizations running Skyline DataMiner with the BrokerGateway component are exposed. The sources do not say whether exposure requires a specific network configuration, so check whether the NATS port is reachable beyond trusted hosts.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":4348,"output_tokens":650,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-89017':15A,18A '10.4.0':138C '10.5.0':135C '10.6.0':133C '10.6.9':131C '4222':67B,122C 'access':59B,118C 'allow':82C 'api':35B,78C 'attack':4A,39B,57B,84C,99C 'brokergateway':11A,19B,31B,74C,91C 'bus':8A,63B,117C 'contain':32B,75C 'credenti':9A,55B,111C,127C 'cu1':132C 'cu19':136C 'cu22':139C 'cu7':134C 'cve':13A,16A 'datamin':2A,27B,29B,70B,73C,126C,130C 'datamineruser.creds':109C 'disabl':47B,98C 'embed':34B,77C 'even':42B,93C 'fix':128C 'gain':113C 'give':56B 'industri':21B 'industrial-iot':20B 'instal':89C 'installation-specif':88C 'iot':22B 'key':12A,36B,50B,79C,92C,104C 'login':71B 'messag':7A,62B,116C 'message-bus':6A,115C 'mode':45B,96C 'nat':23B,54B,110C 'obtain':5A,106C 'pair':44B,95C 'port':66B,121C 'prior':125C 'retriev':41B,49B,86C,103C 'skylin':1A,26B,28B,72C 'skyline-datamin':25B 'specif':90C 'tcp':65B,120C 'trust':58B,114C 'unauthent':3A,38B,83C 'unrestrict':53B,108C 'use':101C 'via':10A,119C 'vulner':80C 'without':68B,123C 'yield':51B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Skyline DataMiner with the BrokerGateway component are exposed. The sources do not say whether exposure requires a specific network configuration, so check whether the NATS port is reachable beyond trusted hosts.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["brokergateway","high","industrialiot","nats","other","skylinedataminer"],"campaign_type":null,"search_a":"'-2026':14A,17A '-89017':15A,18A 'attack':4A 'brokergateway':11A 'bus':8A 'credenti':9A 'cve':13A,16A 'datamin':2A 'key':12A 'messag':7A 'message-bus':6A 'obtain':5A 'skylin':1A 'unauthent':3A 'via':10A","search_b":"'4222':67B 'access':59B 'api':35B 'attack':39B,57B 'brokergateway':19B,31B 'bus':63B 'contain':32B 'credenti':55B 'datamin':27B,29B,70B 'disabl':47B 'embed':34B 'even':42B 'give':56B 'industri':21B 'industrial-iot':20B 'iot':22B 'key':36B,50B 'login':71B 'messag':62B 'mode':45B 'nat':23B,54B 'pair':44B 'port':66B 'retriev':41B,49B 'skylin':26B,28B 'skyline-datamin':25B 'tcp':65B 'trust':58B 'unauthent':38B 'unrestrict':53B 'without':68B 'yield':51B","search_c":"'10.4.0':138C '10.5.0':135C '10.6.0':133C '10.6.9':131C '4222':122C 'access':118C 'allow':82C 'api':78C 'attack':84C,99C 'brokergateway':74C,91C 'bus':117C 'contain':75C 'credenti':111C,127C 'cu1':132C 'cu19':136C 'cu22':139C 'cu7':134C 'datamin':73C,126C,130C 'datamineruser.creds':109C 'disabl':98C 'embed':77C 'even':93C 'fix':128C 'gain':113C 'instal':89C 'installation-specif':88C 'key':79C,92C,104C 'messag':116C 'message-bus':115C 'mode':96C 'nat':110C 'obtain':106C 'pair':95C 'port':121C 'prior':125C 'retriev':86C,103C 'skylin':72C 'specif':90C 'tcp':120C 'trust':114C 'unauthent':83C 'unrestrict':108C 'use':101C 'via':119C 'vulner':80C 'without':123C","first_public_at":"2026-11-06T18:18:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89017","severity":null,"published_at":"2026-11-06T18:18:22+00:00","modified_at":"2026-11-06T18:18:22+00:00","first_seen_at":"2026-11-06T18:44:09+00:00","fetched_at":"2026-11-06T18:44:09+00:00","note":null}],"documents":[{"id":88856,"url":"https://www.vulncheck.com/advisories/skyline-dataminer-brokergateway-embedded-api-key-authentication-bypass","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}