CVE-2026-89292Critical· 9.2▾ MidnightIn Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.
eclipse_mnestix >= 1.6.0 < 2.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86671High· 8.4In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.fetch()`, which calls `new URL(url).openConnection()` with no scheme or host a…
CVE-2026-123059High· 7.5Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts
CVE-2026-123047High· 7.5Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts
CVE-2026-89293High· 8.8Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering
CVE-2026-89295NoneUnauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter
CVE-2026-107597Medium· 5.1jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme