{"id":"CVE-2026-122028","kind":"vulnerability","aliases":["CVE-2026-122028"],"related":[],"title":"Nstbrowser: Local Agent API /agent/info discloses information to remote attackers","description":"A vulnerability has been found in NST Labs Tech Nstbrowser 1.21.0. Affected by this vulnerability is an unknown functionality of the file /agent/info of the component Local Agent API. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Nstbrowser 1.21.0 exposes an unknown function at /agent/info in its Local Agent API that leaks information when a crafted request is sent. A public exploit exists, and the vendor did not respond to disclosure.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["local-agent-api","nstbrowser","other"],"not_affected_if":["localhost-only","not-installed"],"how_to_check":"- Check whether the Nstbrowser version is `1.21.0` on machines that run it\n- Check whether the Local Agent API is reachable from other hosts on the network (unknown from the sources)","fix":null,"status":"open","published_at":"2026-11-04T23:17:22+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","triaged_at":"2026-11-05T00:32:03+00:00","updated_at":"2026-11-05T00:32:03+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-05T00:32:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Nstbrowser: Local Agent API /agent/info discloses information to remote attackers","impact":"low","summary":"Nstbrowser 1.21.0 exposes an unknown function at /agent/info in its Local Agent API that leaks information when a crafted request is sent. A public exploit exists, and the vendor did not respond to disclosure.","audience":"developers","category":"other","nicknames":[],"who_cares":["nstbrowser","local-agent-api"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker reads information exposed by the agent endpoint","analyst_note":"Confirm the Nstbrowser vendor status and whether a fixed version exists, and check whether the Local Agent API binds to all interfaces by default (source: https://nvd.nist.gov/vuln/detail/CVE-2026-122028).","how_to_check":"- Check whether the Nstbrowser version is `1.21.0` on machines that run it\n- Check whether the Local Agent API is reachable from other hosts on the network (unknown from the sources)","plain_action":"","needs_analyst":true,"not_affected_if":["not-installed","localhost-only"],"who_is_affected":"Teams that run Nstbrowser 1.21.0 with its Local Agent API enabled and reachable over the network are exposed. The sources do not say whether the API listens on all interfaces by default, so the exact exposure is unknown. Machines where Nstbrowser is not installed, or where the agent API is bound only to localhost, are less exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000721,"input_tokens":4258,"output_tokens":591,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-122028':13A,16A '-2026':12A,15A '/agent/info':5A,29B,78C '1.21.0':23B,66C 'affect':67C 'agent':3A,19B,33B,83C 'api':4A,20B,34B,84C 'attack':10A,97C 'compon':81C 'contact':114C 'craft':40B 'cve':11A,14A 'disclos':6A,103C 'disclosur':55B,90C,118C 'earli':115C 'exist':47B 'exploit':46B,100C 'expos':24B 'file':77C 'found':60C 'function':27B,74C 'inform':7A,37B,89C 'lab':63C 'launch':95C 'lead':87C 'leak':36B 'local':2A,18B,32B,82C 'local-agent-api':17B 'manipul':86C 'may':108C 'nst':62C 'nstbrowser':1A,21B,22B,65C 'possibl':93C 'public':45B,106C 'remot':9A,98C 'request':41B 'respond':53B,122C 'sent':43B 'tech':64C 'unknown':26B,73C 'use':110C 'vendor':50B,112C 'vulner':57C,70C 'way':125C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Nstbrowser 1.21.0 with its Local Agent API enabled and reachable over the network are exposed. The sources do not say whether the API listens on all interfaces by default, so the exact exposure is unknown. Machines where Nstbrowser is not installed, or where the agent API is bound only to localhost, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["localagentapi","medium","nstbrowser","other"],"campaign_type":null,"first_public_at":"2026-11-04T23:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122028","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122028","severity":null,"published_at":"2026-11-04T23:17:22+00:00","modified_at":"2026-11-04T23:17:23+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","fetched_at":"2026-11-05T00:30:59+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}