---
id: "CVE-2026-122028"
kind: "vulnerability"
aliases: ["CVE-2026-122028"]
title: "Nstbrowser: Local Agent API /agent/info discloses information to remote attackers"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["local-agent-api", "nstbrowser", "other"]
not_affected_if: ["localhost-only", "not-installed"]
published_at: "2026-11-04T23:17:22+00:00"
first_seen_at: "2026-11-05T00:30:59+00:00"
updated_at: "2026-11-05T00:32:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122028", "first_seen_at": "2026-11-05T00:30:59+00:00"}]
exploit_sources: []
---

# Nstbrowser: Local Agent API /agent/info discloses information to remote attackers

Nstbrowser 1.21.0 exposes an unknown function at /agent/info in its Local Agent API that leaks information when a crafted request is sent. A public exploit exists, and the vendor did not respond to disclosure.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Nstbrowser version is `1.21.0` on machines that run it
- Check whether the Local Agent API is reachable from other hosts on the network (unknown from the sources)

## Timeline

- 2026-11-05T00:30:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122028

## From the sources

A vulnerability has been found in NST Labs Tech Nstbrowser 1.21.0. Affected by this vulnerability is an unknown functionality of the file /agent/info of the component Local Agent API. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_