CVE-2026-126802

CVSS 8.8 (high) · published 2026-11-11

NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details and the server token, and impersonate scan nodes via registration, heartbeat and logging endpoints.

Weakness: CWE-798

Source: NVD CVE-2026-126802

References

• https://github.com/tongcheng-security-team/NextScan/issues/50
• https://hub.docker.com/r/lysec/ns-admin
• https://vul.yulun.ac.cn/20261107/nextscan/
• https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-hardcoded-credentials-in-ns-admin-agent-and-external-apis
• https://vul.yulun.ac.cn/20261107/nextscan/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.