CVE-2026-89017

{
  "etk_id": "ETK-2026-3747",
  "cve_id": "CVE-2026-89017",
  "display_id": "CVE-2026-89017",
  "ghsa_id": "GHSA-92qj-9p68-wfhf",
  "euvd_id": "EUVD-2026-118392",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Embedded API key exposure in DataMiner BrokerGateway",
  "summary": "DataMiner installations using the affected BrokerGateway component may expose an installation-specific key to unauthenticated network attackers, including when pairing mode is disabled. An attacker who obtains that key may gain trusted access to the NATS message bus without an existing DataMiner account.",
  "mitigation": "Upgrade DataMiner to 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, or 10.4.0 CU22, as appropriate for the deployed release branch. Restrict network access to BrokerGateway and the NATS service until the update is applied.",
  "vendor": "Skyline Communications",
  "product": "DataMiner",
  "affected": [
    {
      "affected_notes": [
        ">= 10.6.9, < 10.6.9 CU1",
        ">= 10.6.0, < 10.6.0 CU7",
        ">= 10.5.0, < 10.5.0 CU19",
        ">= 10.4.0, < 10.4.0 CU22"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [
        "10.6.9 CU1",
        "10.6.0 CU7",
        "10.5.0 CU19",
        "10.4.0 CU22"
      ],
      "package_name": "DataMiner",
      "purl": null
    }
  ],
  "cwes": [
    798
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 19.33373685,
  "t0_at": "2026-11-06T17:50:47.441000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-06T17:50:47.441000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T17:50:47.441000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89017"
    }
  }
}