PT-2026-136076
CVE-2026-89292
·
Published
2026-11-03
·
Updated
2026-11-03
Description by
CVSS 4.0
9.2
CriticalMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Eclipse Mnestix Browser versions 1.6.0 through 2.2.x
Description
An unauthenticated attacker can perform a Server-Side Request Forgery (SSRF)—a technique where the attacker induces the server to make requests to an unintended location—to exfiltrate the
MNESTIX BACKEND API KEY for all configured infrastructures. This allows the attacker to obtain the shared backend API key and gain access to connected backend systems.Recommendations
Update to version 2.3.0.
Found an issue in the description? Have something to add? Feel free to write us 👾