Read the docs
TI-2026-86054 Aliases CVE-2026-89017GHSA-92qj-9p68-wfhf

Embedded key in Skyline DataMiner BrokerGateway exposes message bus

Priority LOW 37CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Skyline DataMiner BrokerGateway from 10.6.9 before 10.6.9 CU1, from 10.6.0 before 10.6.0 CU7, from 10.5.0 before 10.5.0 CU19, and from 10.4.0 before 10.4.0 CU22 embeds a hard-coded key (CWE-798). An unauthenticated remote attacker can retrieve the installation-specific BrokerGateway key even while pairing mode is disabled. The key yields a NATS credential that grants trusted access to the message bus on TCP port 4222.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Skyline DataMiner BrokerGateway contains an embedded API key vulnerability that allows unauthenticated attackers to retrieve the installation-specific BrokerGateway key even while pairing mode is disabled. Attackers can use the retrieved key to obtain the unrestricted DataMinerUser.creds NATS credential and gain trusted message-bus access via TCP port 4222 without any prior DataMiner credentials. Fixed in DataMiner 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, and 10.4.0 CU22.

Why it matters now

EPSS 0.00308 23rd percentileScored 2026-11-07
Fix Fixed DataMiner (Skyline Communications): 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Skyline CommunicationsDataMiner10.6.9 to before 10.6.9 CU1; 10.6.0 to before 10.6.0 CU7; 10.5.0 to before 10.5.0 CU19; 10.4.0 to before 10.4.0 CU2210.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, 10.4.0 CU22Patch availableCNA
  • DataMiner VendorSkyline Communications Affected 10.6.9 to before 10.6.9 CU1; 10.6.0 to before 10.6.0 CU7; 10.5.0 to before 10.5.0 CU19; 10.4.0 to before 10.4.0 CU22 Fixed in 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, 10.4.0 CU22 Patch available CNA

Remediation

Upgrade DataMiner to 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, or 10.4.0 CU22, depending on the release line in use.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA DataMiner (Skyline Communications) Fixed in 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, 10.4.0 CU22

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-89017
  2. 2026-11-06 Alias added: GHSA-92qj-9p68-wfhf
  3. 2026-11-08 Priority changed: MEDIUM → LOW

References

Patch 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences