Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

Eclipse Mnestix Browser leaks backend API key

CVE-2026-89292 · published 1 day ago
Summary

The Eclipse Mnestix Browser (versions 1.6.0 up to 2.3.0) can reveal its backend API key to anyone on the internet. Anyone who obtains this key could talk to the backend services as if they were an authorized user, potentially accessing sensitive data. Update the software to version 2.3.0 or later and generate new API keys to protect your systems.

What to do
  • Update eclipse foundation eclipse mnestix to version 2.3.0 or later.
Affected software
VendorProductAffected versions
eclipse foundation eclipse mnestix < 2.3.0
Original advisory text
Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures
In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.2 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
CWE-522Insufficiently Protected Credentials
Timeline
Published3 Nov 2026
Updated4 Nov 2026
First seen3 Nov 2026
Sources
CVE-2026-89292 · NVD
CVE-2026-89292 · MITRE
Track software like this
Free during beta