Description

Skyline DataMiner BrokerGateway contains an embedded API key vulnerability that allows unauthenticated attackers to retrieve the installation-specific BrokerGateway key even while pairing mode is disabled. Attackers can use the retrieved key to obtain the unrestricted DataMinerUser.creds NATS credential and gain trusted message-bus access via TCP port 4222 without any prior DataMiner credentials. Fixed in DataMiner 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, and 10.4.0 CU22.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-06T18:18:22.380Z",
  "pubdate": "2026-11-06T18:18:22.380Z",
  "executiveSummary": "Skyline DataMiner BrokerGateway is susceptible to an embedded API key vulnerability, allowing unauthenticated remote attackers to extract installation-specific configuration secrets. This vulnerability exists independently of the device's pairing mode status. By successfully retrieving the BrokerGateway key, an attacker can bypass standard authentication mechanisms to obtain the unrestricted DataMinerUser.creds NATS credentials. This exposure grants the attacker unauthorized access to the internal NATS message bus over TCP port 4222. The ability to interact with the message bus enables malicious actors to perform arbitrary operations within the DataMiner environment, potentially leading to full system compromise. The vulnerability affects multiple versions of the DataMiner platform and requires immediate remediation via identified cumulative updates. Exploitation is trivial, requiring no prior user credentials or complex preconditions, posing a significant risk to the integrity and confidentiality of the affected deployment.",
  "technicalDetails": "The vulnerability resides within the BrokerGateway component of the Skyline DataMiner platform. The root cause is an insecure implementation that exposes an installation-specific API key through the application's interface, even when security hardening features such as pairing mode are explicitly disabled. The BrokerGateway is responsible for managing communications and facilitating the registration of system components; however, it fails to adequately protect the cryptographic materials used for authenticating these internal services.\nThe attack flow commences with the attacker establishing a network connection to the target system. Because the BrokerGateway service exposes the sensitive key to unauthenticated requests, an attacker can query the endpoint to retrieve the key directly. Once the BrokerGateway key is exfiltrated, the attacker leverages it to authenticate against the DataMiner security services. This secondary authentication step allows the attacker to request the DataMinerUser.creds file, which contains the NATS (NATS Messaging) credentials. These credentials provide the bearer with elevated, trusted access to the message bus via TCP port 4222.\nThe NATS message bus is a critical communication backbone within DataMiner, often handling telemetry, control commands, and inter-service messaging. By obtaining the unrestricted NATS credentials, an attacker can inject malicious messages, intercept sensitive data, or issue unauthorized commands to other components connected to the bus, effectively bypassing the platform's intended security architecture. Because the NATS service listens on TCP port 4222, the impact is reachable from any network segment that can route traffic to the DataMiner infrastructure.\nThis vulnerability is present in versions of DataMiner prior to the following cumulative updates: DataMiner 10.6.9 CU1, 10.6.0 CU7, 10.5.0 CU19, and 10.4.0 CU22. There are no authentication or privilege requirements to exploit this flaw, as the vulnerable API endpoint is exposed globally upon service initialization. The impact post-exploitation is critical, as it allows for full control over the message-based communication flow, facilitating arbitrary execution of commands or data exfiltration across the connected DataMiner ecosystem."
}