Is CVE-2026-89292 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89292 being exploited in the wild.

How severe is CVE-2026-89292?

Informational severity, published 3 November 2026.

Which products and versions are affected?

Eclipse Mnestix Browser 1.6.0 to 2.2.0.

Is there a fix for CVE-2026-89292?

Yes: fixed in 2.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89292 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-89292?

Check whether you run Eclipse Mnestix Browser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89292: Eclipse Mnestix Browser unauthenticated SSRF with API key disclosure

CVE-2026-89292 · Severity: info · Published 2026-11-03

Eclipse Mnestix Browser is a web application for managing industrial asset data. An unauthenticated attacker can exploit server-side request forgery to make the application fetch arbitrary URLs and read the responses, while also exfiltrating the backend API key used for infrastructure access. This enables attackers to access internal systems and cloud metadata, or to fully compromise the backend infrastructure.

Vendors: Eclipse.

Quick answers

Is CVE-2026-89292 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89292 being exploited in the wild.
How severe is CVE-2026-89292?: Informational severity, published 3 November 2026.
Which products and versions are affected?: Eclipse Mnestix Browser 1.6.0 to 2.2.0.
Is there a fix for CVE-2026-89292?: Yes: fixed in 2.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89292 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-89292?: Check whether you run Eclipse Mnestix Browser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.3.0

Technical details

The vulnerability exists in Next.js server actions that accept a client-supplied URL and fetch it server-side with attached credentials. When an attacker specifies the "Default Infrastructure" (which always exists), the application automatically appends the MNESTIX_BACKEND_API_KEY as an X-API-KEY header. No authentication is required; affected versions 1.6.0 to 2.2.0 are vulnerable when the authentication feature flag is disabled (the default quick-start configuration).

Affected products

Eclipse Mnestix Browser 1.6.0 to 2.2.0

Timeline

2026-11-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.