CVE-2026-89292: SSRF
Published Nov 3, 2026
·Updated
In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIXBACKENDAPIKEY for all configured Infrastructures.
Event History
Nov 3, 2026
CVE Published
via NVD·10:17 AM
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Eclipse Mnestix Browser versions 1.6.0 through versions before 2.3.0 are affected. The issue exposes the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.
2
Does exploitation require authentication or user interaction?
No. The vulnerability can be exploited by an unauthenticated attacker and does not require user interaction.
3
What is the recommended remediation?
Upgrade Eclipse Mnestix Browser to version 2.3.0 or later. The provided data does not describe a workaround for affected versions.