Is CVE-2026-89293 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89293 being exploited in the wild.

How severe is CVE-2026-89293?

Informational severity, published 3 November 2026.

Which products and versions are affected?

Eclipse Mnestix Browser 1.2.0 to 2.2.0.

How is CVE-2026-89293 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-89293?

Check whether you run Eclipse Mnestix Browser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89293: Eclipse Mnestix Browser missing authorization in admin server actions

CVE-2026-89293 · Severity: info · Published 2026-11-03

Eclipse Mnestix Browser is a web interface for managing industrial asset data. An unauthenticated attacker can bypass the settings page's access controls and directly call administrative functions to modify infrastructure configuration, change security headers, and create connections to backends—even when authentication is enabled. This allows unauthorized alteration of the application's stored configuration and credentials.

Vendors: Eclipse.

Quick answers

Is CVE-2026-89293 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89293 being exploited in the wild.
How severe is CVE-2026-89293?: Informational severity, published 3 November 2026.
Which products and versions are affected?: Eclipse Mnestix Browser 1.2.0 to 2.2.0.
Is there a fix for CVE-2026-89293?: Yes: fixed in 2.3.0. Until then: Disable the `AUTHENTICATION_FEATURE_FLAG` if it is not required, or restrict network access to the Mnestix Browser admin server to trusted networks only until patching is possible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89293 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-89293?: Check whether you run Eclipse Mnestix Browser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.3.0

Disable the `AUTHENTICATION_FEATURE_FLAG` if it is not required, or restrict network access to the Mnestix Browser admin server to trusted networks only until patching is possible.

Technical details

The vulnerability stems from client-side-only authorization: the React-based settings UI enforces access control in the browser (CWE-602), but the underlying server actions and REST endpoints perform no server-side authentication or role checks (CWE-862). An attacker with network access can invoke server actions like `createInfrastructureAction`, `updateInfrastructureAction`, `deleteInfrastructureAction`, and `POST /api/mnestixConnections` directly by knowing their action IDs (which are embedded in public JavaScript bundles), regardless of `AUTHENTICATION_FEATURE_FLAG` setting. This results in write and delete access to the Prisma database storing infrastructure records and credentials.

Affected products

Eclipse Mnestix Browser 1.2.0 to 2.2.0

Timeline

2026-11-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.