CVE-2026-89293High· 8.8▾ TwilightIn Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructur…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.
eclipse_mnestix >= 1.2.0 < 2.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-89292Critical· 9.2Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures
CVE-2026-115231High· 8.5User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege
CVE-2026-89295NoneUnauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter
CVE-2026-115654Medium· 6.9User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own
CVE-2026-94023Medium· 6.9Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion
CVE-2026-123059High· 7.5Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts