Skyline DataMiner BrokerGateway embedded API key exposure (CVE-2026-89017)
An unauthenticated API key vulnerability in Skyline DataMiner BrokerGateway allows attackers to retrieve internal keys and NATS credentials to gain unauthorized message-bus access via TCP port 4222.
CVE search metadata
CVE search record: CVE-2026-89017. Severity: high. CVSS: 7.5. KEV: no. Product: DataMiner BrokerGateway (< 10.6.9 CU1, < 10.6.0 CU7, < 10.5.0 CU19, < 10.4.0 CU22). Brief: Skyline DataMiner BrokerGateway embedded API key exposure (CVE-2026-89017). Brief link: https://feed.craftedsignal.io/briefs/2026-11-skylinedataminer-brokergateway-vuln/
Triage facts
Revision 1- Applicability
- DataMiner BrokerGateway (< 10.6.9 CU1, < 10.6.0 CU7, < 10.5.0 CU19, < 10.4.0 CU22)
- Evidence
- Unknown
- Severity
- High
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Nov 6, 19:23 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Skyline DataMiner BrokerGateway versions prior to 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, and 10.4.0 CU22 contain a vulnerability where an embedded API key is retrievable by unauthenticated attackers even when the pairing mode is disabled. Successful exploitation enables an attacker to retrieve the DataMinerUser.creds NATS credentials and gain unauthorized, trusted access to the message-bus via TCP port 4222.
Impact
Unauthorized actors can obtain trusted message-bus access to the DataMiner system without prior credentials, potentially allowing for the interception or injection of system messages.
Recommendation
Patch DataMiner systems to the fixed versions immediately: 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, or 10.4.0 CU22. Inventory all internet-facing instances of DataMiner BrokerGateway and restrict network access to the NATS message-bus port 4222 to trusted internal segments only.
Immediate actions
Patch DataMiner instances to the specified fixed versions
Threat Hunt
Identify unauthorized TCP 4222 connections to DataMiner BrokerGateway from external or untrusted internal subnets
Data: Firewall or flow logs capturing inbound connections to port 4222
Mitigations
Restrict network access to port 4222 to known, authorized management IPs only
CVE-2026-89017