Embedded API Key Vulnerability in Skyline DataMiner BrokerGateway
CVE-2026-89017

8.7HIGH

Key Information:

Vendor

Skyline Communications

Status
Dataminer
Vendor
CVE Published:
6 November 2026

What is CVE-2026-89017?

The Skyline DataMiner BrokerGateway contains an embedded API key vulnerability that allows unauthorized attackers to access the installation-specific BrokerGateway key. This vulnerability can be exploited even when pairing mode is disabled, enabling attackers to extract unrestricted DataMinerUser.creds NATS credentials. The compromised credentials grant attackers trusted access to the message bus over TCP port 4222 without needing any prior DataMiner authentication. Users are advised to update their systems to fixed versions to mitigate this security risk.

Affected Version(s)

DataMiner 10.6.9

DataMiner 10.6.9 < 10.6.9 CU1

DataMiner 10.6.0 < 10.6.0 CU7

References

https://community.dataminer.services/critical-dataminer-s...
patchvendor-advisory
https://www.vulncheck.com/advisories/skyline-dataminer-br...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

signal11
.