CVE-2026-89017

CVSS 8.7 (high) · published 2026-11-06

Skyline DataMiner BrokerGateway contains an embedded API key vulnerability that allows unauthenticated attackers to retrieve the installation-specific BrokerGateway key even while pairing mode is disabled. Attackers can use the retrieved key to obtain the unrestricted DataMinerUser.creds NATS credential and gain trusted message-bus access via TCP port 4222 without any prior DataMiner credentials. Fixed in DataMiner 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, and 10.4.0 CU22.

Weakness: CWE-306, CWE-798

Source: NVD CVE-2026-89017

References

• https://community.dataminer.services/critical-dataminer-security-upgrade/
• https://www.vulncheck.com/advisories/skyline-dataminer-brokergateway-embedded-api-key-authentication-bypass

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.