Unauthenticated Data Exposure in Eclipse Mnestix Browser
CVE-2026-89292

9.2CRITICAL

Key Information:

Vendor: Eclipse Foundation
Status: Eclipse Mnestix
Vendor: CVE Published:; 3 November 2026

🔔 Create Eclipse Foundation Vulnerability Alert

What is CVE-2026-89292?

In versions of the Eclipse Mnestix Browser from 1.6.0 up to but excluding 2.3.0, a vulnerability existed that enabled unauthenticated attackers to access and exfiltrate the MNESTIX_BACKEND_API_KEY. This exposed API key poses a risk for all configured infrastructures, allowing malicious entities unauthorized access to sensitive operational data.

Affected Version(s)

Eclipse Mnestix 1.6.0 < 2.3.0

References

https://gitlab.eclipse.org/security/vulnerability-reports...

https://gitlab.eclipse.org/security/cve-assignment/-/work...

CVSS V4

Score:

9.2

Severity:

CRITICAL

Confidentiality:

High

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 3, 2026
Vulnerability Reserved
Sep 11, 2026

Credit

Eclipse Foundation Security Team

CVE-2026-89292 Data

JSON