CVE-2026-89293: High severity vulnerability
In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.
Event History
Frequently Asked Questions
Which deployments are affected?
Eclipse Mnestix Browser versions 1.2.0 through versions before 2.3.0 are affected. Version 2.3.0 is not included in the affected range.
Does exploitation require an attacker to authenticate or interact with a user?
No. The vulnerability can be exploited by an unauthenticated attacker, and the supplied CVSS vector indicates network access, low attack complexity, no privileges, and no user interaction are required.
What could an attacker do after exploiting this issue?
An attacker could perform actions restricted to authorized Mnestix users, including changing Infrastructure settings and calling the connected, authenticated Mnestix AAS Generator backend.