Paper/Archive/CVE-2026-89292

CVE-2026-89292

Eclipse Foundation Eclipse Mnestix — Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures

CVSS 9.2

critical.is priorityof 100

CVSS 9.2 (CNA)9.2 / 10 × 3027.6 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.

Affected

ProductAffectedFixed inSource

Eclipse Mnestix1.6.0 – < 2.3.02.3.0CNA

Scores by source

eclipse (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

References

refgitlab.eclipse.org/security/vulnerability-reports/-/work_items/773 refgitlab.eclipse.org/security/cve-assignment/-/work_items/302