---
id: "CVE-2026-89017"
page: "https://infrastack.ai/live/CVE-2026-89017"
kind: "vulnerability"
aliases: ["CVE-2026-89017"]
title: "Skyline DataMiner: unauthenticated attackers obtain message-bus credentials via BrokerGateway key"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["brokergateway", "industrial-iot", "nats", "other", "skyline-dataminer"]
not_affected_if: ["fixed-version"]
published_at: "2026-11-06T18:18:22+00:00"
first_seen_at: "2026-11-06T18:44:09+00:00"
updated_at: "2026-11-06T18:45:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89017", "first_seen_at": "2026-11-06T18:44:09+00:00"}]
exploit_sources: []
---

# Skyline DataMiner: unauthenticated attackers obtain message-bus credentials via BrokerGateway key

Link for people: https://infrastack.ai/live/CVE-2026-89017 (this .md is for agents)

Skyline DataMiner's BrokerGateway contains an embedded API key that unauthenticated attackers can retrieve, even when pairing mode is disabled. The retrieved key yields an unrestricted NATS credential, giving attackers trusted access to the message bus on TCP port 4222 without any DataMiner login.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed DataMiner version against the fixed releases listed in the sources.
- Confirm whether TCP port `4222` on DataMiner BrokerGateway hosts is reachable from untrusted networks.

## Fix

- Upgrade DataMiner to `10.6.9 CU1`, `10.6.0 CU7`, `10.5.0 CU19`, or `10.4.0 CU22`, matching your release line.

## Timeline

- 2026-11-06T18:44:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-89017

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/skyline-dataminer-brokergateway-embedded-api-key-authentication-bypass

## From the sources

Skyline DataMiner BrokerGateway contains an embedded API key vulnerability that allows unauthenticated attackers to retrieve the installation-specific BrokerGateway key even while pairing mode is disabled. Attackers can use the retrieved key to obtain the unrestricted DataMinerUser.creds NATS credential and gain trusted message-bus access via TCP port 4222 without any prior DataMiner credentials. Fixed in DataMiner 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, and 10.4.0 CU22.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_