{"id":"CVE-2026-89292","kind":"vulnerability","aliases":["CVE-2026-89292"],"related":[],"title":"Eclipse Mnestix Browser: unauthenticated attacker can steal backend API keys","description":"In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.","summary":"Eclipse Mnestix Browser versions 1.6.0 up to but excluding 2.3.0 let an unauthenticated attacker extract the MNESTIX_BACKEND_API_KEY for every configured Infrastructure. The stolen key grants access to the backend services those infrastructures connect to.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asset-administration-shell","eclipse","mnestix-browser","package"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed Mnestix Browser version; affected if it is `1.6.0` or later but below `2.3.0`.\n- Confirm whether the `MNESTIX_BACKEND_API_KEY` setting is configured for any Infrastructure.","fix":"- Upgrade Mnestix Browser to `2.3.0` or later.","status":"open","published_at":"2026-11-03T10:17:20+00:00","first_seen_at":"2026-11-03T10:20:16+00:00","triaged_at":"2026-11-03T10:20:32+00:00","updated_at":"2026-11-03T10:20:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T10:20:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Mnestix Browser to `2.3.0` or later.","reach":"internet","title":"Eclipse Mnestix Browser: unauthenticated attacker can steal backend API keys","impact":"high","summary":"Eclipse Mnestix Browser versions 1.6.0 up to but excluding 2.3.0 let an unauthenticated attacker extract the MNESTIX_BACKEND_API_KEY for every configured Infrastructure. The stolen key grants access to the backend services those infrastructures connect to.","audience":"businesses","category":"package","nicknames":[],"who_cares":["mnestix-browser","eclipse","asset-administration-shell"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker obtains backend API key, gaining access to connected infrastructure backends","analyst_note":"Check the Eclipse advisory or NVD entry for the exact exposure path and whether a default or specific configuration is required.","how_to_check":"- Check the installed Mnestix Browser version; affected if it is `1.6.0` or later but below `2.3.0`.\n- Confirm whether the `MNESTIX_BACKEND_API_KEY` setting is configured for any Infrastructure.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams running Eclipse Mnestix Browser between versions 1.6.0 and 2.3.0 with the MNESTIX_BACKEND_API_KEY configured for their infrastructures. The sources do not describe the exact exposure path, so treat any deployment in that range as in scope. Deployments outside the affected version range can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000727,"input_tokens":4125,"output_tokens":628,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-89292':13A,16A '1.6.0':30B,67C '2.3.0':35B,72C 'access':54B 'administr':19B 'api':9A,44B,85C 'asset':18B 'asset-administration-shel':17B 'attack':5A,39B,79C 'backend':8A,43B,57B,84C 'browser':3A,24B,28B,65C 'configur':48B,89C 'connect':61B 'cve':11A,14A 'eclips':1A,21B,26B,63C 'everi':47B 'exclud':34B,71C 'exfiltr':81C 'extract':40B 'grant':53B 'infrastructur':49B,60B,90C 'key':10A,45B,52B,86C 'let':36B 'mnestix':2A,23B,27B,42B,64C,83C 'mnestix-brows':22B 'packag':25B 'possibl':75C 'servic':58B 'shell':20B 'steal':7A 'stolen':51B 'unauthent':4A,38B,78C 'version':29B,66C","nicknames":[],"mitigations":[],"who_affected":"Teams running Eclipse Mnestix Browser between versions 1.6.0 and 2.3.0 with the MNESTIX_BACKEND_API_KEY configured for their infrastructures. The sources do not describe the exact exposure path, so treat any deployment in that range as in scope. Deployments outside the affected version range can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["assetadministrationshell","critical","eclipse","mnestixbrowser","package"],"first_public_at":"2026-11-03T10:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89292","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89292","severity":null,"published_at":"2026-11-03T10:17:20+00:00","modified_at":"2026-11-03T10:17:20+00:00","first_seen_at":"2026-11-03T10:20:16+00:00","fetched_at":"2026-11-03T10:20:16+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}