Live › vulnerability › CVE-2026-89292
Eclipse Mnestix Browser versions 1.6.0 up to but excluding 2.3.0 let an unauthenticated attacker extract the MNESTIX_BACKEND_API_KEY for every configured Infrastructure. The stolen key grants access to the backend services those infrastructures connect to.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 10:20 UTC. All times on this page are UTC.
Teams running Eclipse Mnestix Browser between versions 1.6.0 and 2.3.0 with the MNESTIX_BACKEND_API_KEY configured for their infrastructures. The sources do not describe the exact exposure path, so treat any deployment in that range as in scope. Deployments outside the affected version range can skip it.
No product ranges from the sources yet.
1.6.0 or later but below 2.3.0.MNESTIX_BACKEND_API_KEY setting is configured for any Infrastructure.2.3.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.
This page as .md · .json · in your agent: get_signal("CVE-2026-89292")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.