Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Skyline Communications | DataMiner | affected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 06 Nov 2026 18:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Skyline DataMiner BrokerGateway contains an embedded API key vulnerability that allows unauthenticated attackers to retrieve the installation-specific BrokerGateway key even while pairing mode is disabled. Attackers can use the retrieved key to obtain the unrestricted DataMinerUser.creds NATS credential and gain trusted message-bus access via TCP port 4222 without any prior DataMiner credentials. Fixed in DataMiner 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, and 10.4.0 CU22. | |
| Title | Skyline DataMiner BrokerGateway Embedded API Key Authentication Bypass | |
| Weaknesses | CWE-306 CWE-798 |
|
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-06T17:50:47.441Z
Reserved: 2026-09-10T16:23:54.471Z
Link: CVE-2026-89017
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-06T18:18:22.380
Modified: 2026-11-06T18:18:22.380
Link: CVE-2026-89017
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-06T19:45:08Z