NS-ADMIN · CVE-2026-126797 · Other
NO FIX YET · SEE WHAT TO DO
NextScan versions 1.1.0 through 1.2.0 ship a hardcoded JWT signing key in the ns-admin component. An unauthenticated attacker can forge an administrator token and gain full access to user management, scan tasks and stored vulnerability results.
first public Nov 11, 2026 · 1 public exploit · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted NextScan (Tongcheng ns-admin) 1.1.0 to 1.2.0, including the published images 1.1.0, 1.1.1 and 1.2.0. Any deployment whose ns-admin web/API port is reachable by an attacker is exposed with no preconditions, including the official docker-compose setup, which publishes port 80. The key is hardcoded and cannot be changed by configuration. Teams that do not run NextScan, or keep ns-admin reachable only from a trusted network or VPN, face much less risk.
Not affected if not-network-reachable, version-outside-range
Who cares auth-bypass, docker, nextscan, ns-admin, self-hosted
1.1.0, 1.1.1 or 1.2.0 (docker ps --format {{.Image}} | grep ns-admin) or the v1.2.0 ns-admin binary? You are exposed if the ns-admin port (80 in the official compose) is reachable by anyone untrustedNextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full access to user management, scan tasks and stored vulnerability results.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
No fixed version known: the maintainers' GitHub issue #48 (opened 2026-11-07) is still open with no reply, and the key cannot be changed by configuration.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.