Advisory · CVE-2026-89017
Skyline DataMiner BrokerGateway embedded API key gives trusted message-bus access
Skyline DataMiner BrokerGateway contains an embedded API key that unauthenticated attackers can retrieve even while pairing mode is disabled, then use to obtain the unrestricted DataMinerUser.creds NATS credential and gain trusted message-bus access via TCP port 4222.
- Vendor
- Skyline Communications
- Product
- DataMiner
- Identifier / CWE
- CVE-2026-89017
CWE-306, CWE-798 - Action timing
- Immediate
Explain it like I’m five
The gateway carries a spare key hidden inside it that anyone can ask for, even when pairing is switched off. That key opens the internal message bus, where the system trusts whatever it hears.
- 01Key retrieved
An unauthenticated attacker retrieves the installation-specific BrokerGateway key, even with pairing mode disabled.
- 02NATS credential obtained
The key is exchanged for the unrestricted DataMinerUser.creds NATS credential.
- 03Message bus joined
The attacker connects to the NATS message bus on TCP port 4222 as a trusted participant.
- 04Trusted access abused
With trusted message-bus access, the attacker can interact with DataMiner services that trust bus messages.
What happened
Skyline DataMiner BrokerGateway contains an embedded API key vulnerability. An unauthenticated attacker can retrieve the installation-specific BrokerGateway key even while pairing mode is disabled, then use it to obtain the unrestricted DataMinerUser.creds NATS credential and gain trusted message-bus access via TCP port 4222 without any prior DataMiner credentials. The vulnerability was discovered and responsibly disclosed by signal11. The vendor bulletin strongly recommends upgrading, and lists the fix in DataMiner 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, and 10.4.0 CU22. The record rates it high at CVSS 8.7 under version 4.0 and 7.5 under version 3.1.
The 10.4.0 CU22 release is an out-of-band update for customers who remain on the 10.4 main release track, which no longer receives regular updates but is still within its support period; it carries the same security fixes so those systems can be patched without moving to a newer main release. The vendor bulletin notes the upgrades include multiple critical security fixes; this advisory covers only this CVE.
What to do
- Inventory DataMiner systems and record each version and cumulative update.
- Upgrade to DataMiner 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, or 10.4.0 CU22, matching the deployed main release track.
- Until upgraded, restrict network access to BrokerGateway and to the NATS message bus on TCP port 4222.
- Review logs for unauthorized BrokerGateway key retrieval and for unexpected NATS connections or credential use.
- Rotate DataMiner credentials if unauthorized bus access cannot be excluded.
- Verify the deployed version after updating.
Management note
An embedded key that bypasses pairing is a trust-boundary failure in the message bus, not a configuration oversight. Patch to a fixed cumulative update, then audit who has been talking to the bus.