CVE-2026-89017
Skyline DataMiner BrokerGateway Embedded API Key Authentication Bypass
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Skyline DataMiner BrokerGateway contains an embedded API key vulnerability that allows unauthenticated attackers to retrieve the installation-specific BrokerGateway key even while pairing mode is disabled. Attackers can use the retrieved key to obtain the unrestricted DataMinerUser.creds NATS credential and gain trusted message-bus access via TCP port 4222 without any prior DataMiner credentials. Fixed in DataMiner 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, and 10.4.0 CU22.
| CWE | CWE-798 CWE-306 |
| Vendor | skyline communications |
| Product | dataminer |
| Published | Nov 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for skyline communications dataminer
Be the first to know when new high vulnerabilities affecting skyline communications dataminer are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Skyline Communications / DataMiner
10.6.9 < 10.6.9 CU1 10.6.0 < 10.6.0 CU7 10.5.0 < 10.5.0 CU19 10.4.0 < 10.4.0 CU22
References
Credits
signal11