# CVE-2026-89292: Eclipse Mnestix Browser unauthenticated SSRF with API key disclosure

Source: https://junglewise.ai/threats/cve-2026-89292-in-eclipse-mnestix-browser-versions-1-6-0-up-until-but-excluding  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-89292 · Severity: info · Published 2026-11-03

Eclipse Mnestix Browser is a web application for managing industrial asset data. An unauthenticated attacker can exploit server-side request forgery to make the application fetch arbitrary URLs and read the responses, while also exfiltrating the backend API key used for infrastructure access. This enables attackers to access internal systems and cloud metadata, or to fully compromise the backend infrastructure.

Vendors: [Eclipse](https://junglewise.ai/threats/vendors/eclipse).

## Quick answers

**Is CVE-2026-89292 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89292 being exploited in the wild.

**How severe is CVE-2026-89292?** Informational severity, published 3 November 2026.

**Which products and versions are affected?** Eclipse Mnestix Browser 1.6.0 to 2.2.0.

**Is there a fix for CVE-2026-89292?** Yes: fixed in 2.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-89292 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-89292?** Check whether you run Eclipse Mnestix Browser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.3.0

## Technical details

The vulnerability exists in Next.js server actions that accept a client-supplied URL and fetch it server-side with attached credentials. When an attacker specifies the "Default Infrastructure" (which always exists), the application automatically appends the MNESTIX_BACKEND_API_KEY as an X-API-KEY header. No authentication is required; affected versions 1.6.0 to 2.2.0 are vulnerable when the authentication feature flag is disabled (the default quick-start configuration).

## Affected products

- Eclipse Mnestix Browser 1.6.0 to 2.2.0

## Timeline

- 2026-11-03: disclosed

## References

- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/302](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/302)
- [https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/773](https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/773)

## Related threats

- [Eclipse Mnestix Browser missing authorization in admin server actions](https://junglewise.ai/threats/cve-2026-89293-in-eclipse-mnestix-browser-versions-1-2-0-up-until-but-excluding)