Critical · 9.2 CVE-2026-89292 EUVD-2026-115727GHSA-c7g8-f337-8fr6

Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures

Published Nov 3, 2026 · Updated Nov 3, 2026 · Assigned by eclipse

Vendor: Eclipse Foundation Product: Eclipse Mnestix

Description

In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.

Affected products

Vendor	Product	Affected	Fixed
Eclipse Foundation	Eclipse Mnestix	1.6.0 – < 2.3.0	2.3.0

References

https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/773
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/302