What is GHSA-92qj-9p68-wfhf?

GHSA-92qj-9p68-wfhf is a security advisory published by GitHub Security Advisories with High severity. Skyline DataMiner BrokerGateway contains an embedded API key vulnerability that allows...

Which CVE IDs does GHSA-92qj-9p68-wfhf cover?

GHSA-92qj-9p68-wfhf covers the following CVE IDs: CVE-2026-89017. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-92qj-9p68-wfhf?

GHSA-92qj-9p68-wfhf has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-92qj-9p68-wfhfHighCVSS 7.5

Skyline DataMiner BrokerGateway contains an embedded API key vulnerability that allows...

Vendor

GitHub Security Advisories

Published

November 6, 2026

Last Modified

November 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-89017 →

📋 Description

Skyline DataMiner BrokerGateway contains an embedded API key vulnerability that allows unauthenticated attackers to retrieve the installation-specific BrokerGateway key even while pairing mode is disabled. Attackers can use the retrieved key to obtain the unrestricted DataMinerUser.creds NATS credential and gain trusted message-bus access via TCP port 4222 without any prior DataMiner credentials. Fixed in DataMiner 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, and 10.4.0 CU22.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-89017
https://community.dataminer.services/critical-dataminer-security-upgrade
https://www.vulncheck.com/advisories/skyline-dataminer-brokergateway-embedded-api-key-authentication-bypass
https://github.com/advisories/GHSA-92qj-9p68-wfhf