CVE-2026-89017 in DataMiner
Summary
by MITRE • 11/06/2026
Skyline DataMiner BrokerGateway contains an embedded API key vulnerability that allows unauthenticated attackers to retrieve the installation-specific BrokerGateway key even while pairing mode is disabled. Attackers can use the retrieved key to obtain the unrestricted DataMinerUser.creds NATS credential and gain trusted message-bus access via TCP port 4222 without any prior DataMiner credentials. Fixed in DataMiner 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, and 10.4.0 CU22.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified within Skyline DataMiner BrokerGateway represents a critical failure in access control mechanisms for the embedded API key used to authenticate with the NATS message bus. This flaw allows unauthenticated remote attackers to retrieve an installation-specific BrokerGateway key, even when pairing mode is explicitly disabled. The presence of this hardcoded or persistently accessible credential bypasses standard authentication protocols that are designed to restrict access to sensitive system components. By exploiting this weakness, adversaries can obtain unrestricted DataMinerUser.creds NATS credentials without possessing any prior valid DataMiner user credentials. This effectively grants the attacker trusted message-bus access via TCP port 4222, enabling them to interact with internal services as if they were a legitimate, privileged system component.
From a technical perspective, this vulnerability is classified under CWE-798: Use of Hard-coded Credentials and CWE-287: Improper Authentication. The core issue lies in the exposure of sensitive authentication material that should be dynamically generated or securely stored rather than being retrievable through unauthenticated API calls. The ability to access the NATS message bus on port 4222 is particularly severe because this protocol often facilitates communication between microservices and critical infrastructure components within the DataMiner architecture. Once an attacker gains trusted access, they can potentially inject malicious messages, intercept sensitive data exchanges, or manipulate system configurations that rely on the integrity of the message bus. This aligns with MITRE ATT&CK technique T1078: Valid Accounts, as the attacker leverages valid but improperly protected credentials to maintain persistence and expand their foothold within the network environment.
The operational impact of this vulnerability is substantial, potentially leading to a complete compromise of the Skyline DataMiner installation. An adversary with access to the NATS message bus can execute arbitrary commands on connected agents, modify monitoring configurations, or exfiltrate critical telemetry data collected by the platform. Since the BrokerGateway acts as a central point for communication between various components, compromising it provides a strategic advantage that facilitates lateral movement and deeper infiltration into the target network. The fact that this occurs even when pairing mode is disabled indicates that the security boundary was fundamentally flawed in its default configuration or implementation logic, making systems vulnerable out-of-the-box unless specific mitigations are applied by administrators who may not be aware of this specific risk vector.
To mitigate this vulnerability, organizations must immediately apply the provided software updates which address the underlying code flaw preventing unauthorized retrieval of the BrokerGateway key. The affected versions include DataMiner 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, and 10.4.0 CU22. Until patches are applied, administrators should consider network-level controls such as restricting access to TCP port 4222 using firewalls or intrusion prevention systems to limit exposure to trusted internal subnets only. Additionally, implementing strict monitoring for unusual NATS traffic patterns can help detect potential exploitation attempts in real-time. It is also recommended to review and rotate any credentials that may have been exposed if the vulnerability was actively exploited prior to patching, ensuring that no residual access remains for unauthorized entities within the message bus infrastructure.