Eclipse Mnestix Browser EUVD-2026-115727

The attacker must have network access to a running Eclipse Mnestix Browser instance at version 1.6.0 through any release before 2.3.0 that has one or more Infrastructures configured with a MNESTIX_BACKEND_API_KEY - the keys being exfiltrated must exist in the deployment. Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication, no special attack requirement, and no user interaction are needed against affected versions, so the primary limiting factors are reachability of the instance over the network and the affected version range; the specific SSRF trigger (which endpoint or parameter is abused) is not described in the available sources.

Multiple signals align toward genuine priority despite incomplete telemetry. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with high confidentiality impact on both the vulnerable system (VC:H) and a subsequent system (SC:H), consistent with a CWE-918 SSRF that leaks a backend API key reaching other infrastructures. The vuln.today Decision label is act_now, and the vulnerability was reported by Eclipse itself, lending vendor credibility to the affected-version range. However, key risk signals are MISSING rather than conflicting: no EPSS exploitation-probability score is provided, the CVE is not listed in CISA KEV, and the two supplied references are Eclipse GitLab vulnerability-report/CVE-assignment tracking pages, not working exploit code - so there is no public exploit identified at time of analysis. The act_now label combined with the unauthenticated-network CVSS argues for prompt patching, but the real-world blast radius is tempered by the product's narrow deployment footprint (Eclipse Mnestix is a niche Industry 4.0 Asset Administration Shell browser, not ubiquitous enterprise software). Net: a high-severity, credible, act_now-rated credential-exposure flaw whose theoretical ease of exploitation is high but whose observed exploitation and automation signals are currently unverified.

A remote, unauthenticated attacker sends a crafted request to an exposed Eclipse Mnestix Browser instance (version 1.6.0 through pre-2.3.0) and abuses the SSRF condition to retrieve the MNESTIX_BACKEND_API_KEY configured for all Infrastructures. With that key, the attacker can then authenticate to and act against the backend services those keys protect. No authentication or user interaction is required per the CVSS vector (PR:N/UI:N), though no working public exploit code has been identified at time of analysis.