Eclipse Mnestix Browser server request forgery leaks API key

Web tool for industrial asset data can leak its server key!

Summary

In Eclipse Mnestix Browser versions 1.6.0 up to but excluding 2.3.0, an unauthenticated attacker can steal the MNESTIX_BACKEND_API_KEY for all configured infrastructures. It is a server-side request forgery (SSRF) and credential exposure flaw.

What to do

Update to version 2.3.0 or newer.

Products and platforms

Eclipse Mnestix

CVE IDs

CVE-2026-89292 (opens in a new tab)

Sources

CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-03 09:31 UTC

First seen 2026-11-09 14:10 UTC