{"metadata": {"vulnerability": "CVE-2026-89292", "count": 19, "kinds": {"milestone": 4, "sighting": 6, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-11T12:47:13.045Z", "date_only": false, "value": "2026-09-11T12:47:13.045Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-89292", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-03T09:28:00Z", "date_only": false, "value": "2026-11-03T09:28:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / eclipse", "record": "CVE-2026-89292", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-03T09:31:27.136Z", "date_only": false, "value": "2026-11-03T09:31:27.136Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-89292", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-03T09:31:27.136Z", "date_only": false, "value": "2026-11-03T09:31:27.136Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / eclipse", "record": "CVE-2026-89292", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-03T09:42:07.424Z", "date_only": false, "value": "2026-11-03T09:42:07.424858Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117551852425688748", "record": "CVE-2026-89292", "field": "creation_timestamp", "uuid": "57370215-6d80-4c95-a64a-0e2742d28109", "content": "CVE-2026-89292 Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.\nhttps://www.cve.org/CVERecord?id=CVE-2026-89292https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/773https://gitlab.eclipse.org/security/cve-assignment/-/work_items/302#eclipse #EclipseFoundation #EclipseMnestix#CVE_2026_89292#bot", "url": "https://infosec.exchange/users/cve/statuses/117551852425688748"}, {"timestamp": "2026-11-03T10:17:20Z", "date_only": false, "value": "2026-11-03T10:17:20Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-C7G8-F337-8FR6", "record": "GHSA-C7G8-F337-8FR6", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-03T10:17:20.077Z", "date_only": false, "value": "2026-11-03T10:17:20.077", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89292", "record": "FKIE_CVE-2026-89292", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T10:50:04.523Z", "date_only": false, "value": "2026-11-03T10:50:04.523257Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzfo577psb2f", "record": "CVE-2026-89292", "field": "creation_timestamp", "uuid": "f5f655ee-11ee-4b79-aad0-3fe9f9c65ae6", "content": "CVE-2026-89292 - eclipse mnestix\nThe Eclipse Mnestix Browser (versions 1.6.0 up to 2.3.0) can reveal its backend API key to anyone on the internet. Anyone who obtains this key could talk to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#eclipsemnestix #eclipsefoundation #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzfo577psb2f"}, {"timestamp": "2026-11-03T11:38:22.980Z", "date_only": false, "value": "2026-11-03T11:38:22.980537Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/aubz3rpvhvtud", "record": "CVE-2026-89292", "field": "creation_timestamp", "uuid": "3c17c4f3-11dd-4ca3-80e0-a0982c0e62fd", "content": "CVE-2026-89292 - Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures\nCVE ID : CVE-2026-89292\n \n Published : Nov. 3, 2026, 10:17 a.m. | 47\u00a0minutes ago\n \n Description : In Eclipse Mnestix Browser v...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/aubz3rpvhvtud"}, {"timestamp": "2026-11-03T12:07:18.428Z", "date_only": false, "value": "2026-11-03T12:07:18.428880Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzfshd4nbt24", "record": "CVE-2026-89292", "field": "creation_timestamp", "uuid": "c9a764ca-6bba-4b98-b958-42c33bc09c1b", "content": "\ud83d\udea8 CVE-2026-89292 \u2014 CVSS 9.2 CRITICAL\n\nIn Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticat...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-89292\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzfshd4nbt24"}, {"timestamp": "2026-11-03T12:31:48Z", "date_only": false, "value": "2026-11-03T12:31:48Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-C7G8-F337-8FR6", "record": "GHSA-C7G8-F337-8FR6", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T12:31:48Z", "date_only": false, "value": "2026-11-03T12:31:48Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-C7G8-F337-8FR6", "record": "GHSA-C7G8-F337-8FR6", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-03T13:31:49.889Z", "date_only": false, "value": "2026-11-03T13:31:49.889923Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117552751312532901", "record": "CVE-2026-89292", "field": "creation_timestamp", "uuid": "840928de-8f98-4a21-9cc1-3fa841d118b9", "content": "CVE-2026-89292 | Eclipse Mnestix Browser (v1.6.0 \u2013 <2.3.0): CRITICAL bug allows unauthenticated extraction of backend API keys \ud83d\udddd\ufe0f. Restrict access, monitor for patch info. No known exploit in wild. https://radar.offseq.com/threat/in-eclipse-mnestix-browser-versions-160-up-until-but-excluding-230-it-was-possible-for-an-0d3db4ce36b8acbe #OffSeq #CVE202689292 #infosec", "url": "https://infosec.exchange/users/offseq/statuses/117552751312532901"}, {"timestamp": "2026-11-03T19:59:44.316Z", "date_only": false, "value": "2026-11-03T19:59:44.316109Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/6honixwnl2qoc", "record": "CVE-2026-89292", "field": "creation_timestamp", "uuid": "e58a64b9-c629-4218-9c56-86cce3422045", "content": "\ud83d\udea8 CVE-2026-89292\nCVSS 9.2 / EPSS 0.45% / KEV: No\nTL;DR: In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for\u2026\nhttps://cvesentinel.com/report/CVE-2026-89292\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/6honixwnl2qoc"}, {"timestamp": "2026-11-03T20:19:11.802Z", "date_only": false, "value": "2026-11-03T20:19:11.802670Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-89292", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-03T20:19:11.802Z", "date_only": false, "value": "2026-11-03T20:19:11.802670Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89292", "record": "FKIE_CVE-2026-89292", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-03T20:19:27.496Z", "date_only": false, "value": "2026-11-03T20:19:27.496Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-89292", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-03T20:19:27.496Z", "date_only": false, "value": "2026-11-03T20:19:27.496Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-89292", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-03T21:17:45.263Z", "date_only": false, "value": "2026-11-03T21:17:45.263", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89292", "record": "FKIE_CVE-2026-89292", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-08T11:36:15.406Z", "anchors": {"origin": {"timestamp": "2026-11-03T09:28:00Z", "date_only": false, "value": "2026-11-03T09:28:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / eclipse", "record": "CVE-2026-89292", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-03T09:28:00Z", "date_only": false, "value": "2026-11-03T09:28:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / eclipse", "record": "CVE-2026-89292", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 439695.406714, "hours": 122.1376129761111, "days": 5.089067207337963, "min_seconds": 439695.406714, "max_seconds": 439695.406714, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-03T09:28:00Z", "date_only": false, "value": "2026-11-03T09:28:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / eclipse", "record": "CVE-2026-89292", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-08T11:36:15.406Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}