Eclipse Foundation Eclipse Mnestix vulnerabilities

Latest Eclipse Foundation Eclipse Mnestix CVEs

Newest publication first

1. CVE-2026-89295 Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameter

   Published 2026-11-03

   High·CVSS 7.5 EPSS 0.43%

   In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service g...

2. CVE-2026-89293 Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering

   Published 2026-11-03

   High·CVSS 8.8 EPSS 0.46%

   In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and aut...

3. CVE-2026-89292 Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures

   Published 2026-11-03

   Critical·CVSS 9.2 EPSS 0.45%

   In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.