NEXTSCAN · CVE-2026-126802 · Other
NO FIX YET · SEE WHAT TO DO
NextScan 1.1.0 through 1.2.0 ships hardcoded HTTP Basic Auth credentials in its ns-admin AuthAgent and AuthExternal routers. An unauthenticated attacker can call /agent/config to read Redis passwords, etcd details and the server token, and impersonate scan nodes.
first public Nov 11, 2026 · 1 public exploit · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted NextScan deployments running 1.1.0, 1.1.1 or 1.2.0 (docker image lysec/ns-admin or the ns-admin binary) where the ns-admin port can be reached by anyone untrusted. The agent API accepts two hardcoded Basic Auth pairs that a deployment cannot change, and the researcher's report shows /agent/config returning the Redis password and server token. Teams that keep ns-admin on a private network or behind a firewall allowlist have much lower exposure.
Not affected if network-restricted, not-internet-exposed
Who cares docker, hardcoded-credentials, nextscan, ns-admin, self-hosted
1.1.0, 1.1.1 or 1.2.0 (image lysec/ns-admin)? From a host that can reach ns-admin, run: curl -s -u nextagent:nextagent http://<host>/agent/config?group=2NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details and the server token, and impersonate scan nodes via registration, heartbeat and logging endpoints.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
v1.2.0 (affected) and the maintainers' issue #50 is openThis page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.