CVE-2026-126802

NextScan auth bypass in ns-admin agent and external APIs

high · 8.8

NextScan

Published Nov 11, 2026, 20:53 UTC

Description

NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details and the server token, and impersonate scan nodes via registration, heartbeat and logging endpoints.

Official CVE record View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.