{"id":"CVE-2026-126802","kind":"vulnerability","aliases":["CVE-2026-126802"],"related":[],"title":"NextScan 1.1.0–1.2.0: hardcoded agent API credentials (nextagent:nextagent) expose Redis password and server token","description":"NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details and the server token, and impersonate scan nodes via registration, heartbeat and logging endpoints.","summary":"NextScan 1.1.0 through 1.2.0 ships hardcoded HTTP Basic Auth credentials in its ns-admin AuthAgent and AuthExternal routers. An unauthenticated attacker can call /agent/config to read Redis passwords, etcd details and the server token, and impersonate scan nodes.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NextScan","fixed":[],"affected":">= 1.1.0, <= 1.2.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["docker","hardcoded-credentials","nextscan","ns-admin","other","self-hosted"],"not_affected_if":["network-restricted","not-internet-exposed"],"how_to_check":"Run NextScan 1.1.0, 1.1.1 or 1.2.0 (image lysec/ns-admin)? From a host that can reach ns-admin, run: curl -s -u nextagent:nextagent 'http://<host>/agent/config?group=2'. A JSON reply with Redis.Password and ServerToken means you are exposed. Also check whether ns-admin (default port 80) is reachable from untrusted networks.","fix":"No fixed version known. The newest release listed is v1.2.0 (affected) and the maintainers' issue #50 is open. Until a fix ships, do not expose ns-admin to untrusted networks.","status":"open","published_at":"2026-11-11T21:16:43+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","triaged_at":"2026-11-11T21:30:34+00:00","updated_at":"2026-11-11T21:32:56+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-11T21:30:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"NextScan: hardcoded admin credentials expose Redis and etcd secrets","impact":"high","summary":"NextScan 1.1.0 through 1.2.0 ships hardcoded HTTP Basic Auth credentials in its ns-admin AuthAgent and AuthExternal routers. An unauthenticated attacker can call /agent/config to read Redis passwords, etcd details and the server token, and impersonate scan nodes.","audience":"businesses","category":"other","nicknames":[],"who_cares":["nextscan","ns-admin","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads Redis and etcd secrets and impersonates scan nodes","analyst_note":"Find the NextScan fixed version and any mitigation from the NVD entry or the VulnCheck advisory (www.vulncheck.com) to fill fix and how_to_check.","how_to_check":"- Check whether the NextScan version in use is `1.1.0` through `1.2.0`\n- Look for exposure of the ns-admin service to untrusted networks\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"NextScan deployments at versions 1.1.0 through 1.2.0 where the ns-admin service is reachable, since its AuthAgent and AuthExternal routers accept the hardcoded credentials. The sources do not say which deployment settings change exposure, so unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000747,"input_tokens":4635,"output_tokens":567,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the NextScan fixed version and any mitigation from the NVD entry or the VulnCheck advisory (www.vulncheck.com) to fill fix and how_to_check.","search":"'-126802':18A,21A '-2026':17A,20A '/agent/config':59B,104C '1.1.0':2A,36B,75C '1.2.0':3A,38B,77C 'access':98C 'admin':30B,49B,87C 'agent':5A 'allow':94C 'api':6A,100C 'attack':56B,96C,101C 'auth':43B,82C 'authag':50B,89C 'authextern':52B,91C 'basic':42B,81C 'call':58B,103C 'contain':78C 'credenti':7A,26B,44B,83C 'cve':16A,19A 'detail':65B,110C 'docker':23B 'endpoint':124C 'etcd':64B,109C 'expos':10A 'hardcod':4A,25B,40B,79C 'hardcoded-credenti':24B 'heartbeat':121C 'host':34B 'http':41B,80C 'imperson':71B,116C 'log':123C 'nextag':8A,9A 'nextscan':1A,22A,27B,35B,74C 'node':73B,118C 'ns':29B,48B,86C 'ns-admin':28B,47B,85C 'obtain':106C 'password':12A,63B,108C 'protect':99C 'read':61B 'redi':11A,62B,107C 'registr':120C 'router':53B,92C 'scan':72B,117C 'self':33B 'self-host':32B 'server':14A,68B,113C 'ship':39B 'token':15A,69B,114C 'unauthent':55B,95C 'via':119C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted NextScan deployments running 1.1.0, 1.1.1 or 1.2.0 (docker image lysec/ns-admin or the ns-admin binary) where the ns-admin port can be reached by anyone untrusted. The agent API accepts two hardcoded Basic Auth pairs that a deployment cannot change, and the researcher's report shows /agent/config returning the Redis password and server token. Teams that keep ns-admin on a private network or behind a firewall allowlist have much lower exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["nextscan"],"ptokens":["nextscan"],"labels":["docker","hardcodedcredentials","high","nextscan","nsadmin","other","selfhosted"],"campaign_type":null,"search_a":"'-126802':18A,21A '-2026':17A,20A '1.1.0':2A '1.2.0':3A 'agent':5A 'api':6A 'credenti':7A 'cve':16A,19A 'expos':10A 'hardcod':4A 'nextag':8A,9A 'nextscan':1A,22A 'password':12A 'redi':11A 'server':14A 'token':15A","search_b":"'/agent/config':59B '1.1.0':36B '1.2.0':38B 'admin':30B,49B 'attack':56B 'auth':43B 'authag':50B 'authextern':52B 'basic':42B 'call':58B 'credenti':26B,44B 'detail':65B 'docker':23B 'etcd':64B 'hardcod':25B,40B 'hardcoded-credenti':24B 'host':34B 'http':41B 'imperson':71B 'nextscan':27B,35B 'node':73B 'ns':29B,48B 'ns-admin':28B,47B 'password':63B 'read':61B 'redi':62B 'router':53B 'scan':72B 'self':33B 'self-host':32B 'server':68B 'ship':39B 'token':69B 'unauthent':55B","search_c":"'/agent/config':104C '1.1.0':75C '1.2.0':77C 'access':98C 'admin':87C 'allow':94C 'api':100C 'attack':96C,101C 'auth':82C 'authag':89C 'authextern':91C 'basic':81C 'call':103C 'contain':78C 'credenti':83C 'detail':110C 'endpoint':124C 'etcd':109C 'hardcod':79C 'heartbeat':121C 'http':80C 'imperson':116C 'log':123C 'nextscan':74C 'node':118C 'ns':86C 'ns-admin':85C 'obtain':106C 'password':108C 'protect':99C 'redi':107C 'registr':120C 'router':92C 'scan':117C 'server':113C 'token':114C 'unauthent':95C 'via':119C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T21:16:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-126802","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126802","severity":null,"published_at":"2026-11-11T21:16:43+00:00","modified_at":"2026-11-11T21:16:43+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","fetched_at":"2026-11-11T21:29:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126802:3600","url":"https://github.com/tongcheng-security-team/NextScan/issues/50","severity":null,"published_at":"2026-11-11T21:32:56+00:00","modified_at":"2026-11-11T21:32:56+00:00","first_seen_at":"2026-11-11T21:32:56+00:00","fetched_at":"2026-11-11T21:32:56+00:00","note":"Read VulnCheck advisory, researcher report (vul.yulun.ac.cn) and GitHub issue #50 (open, no maintainer reply). Releases page shows v1.2.0 latest, no fixed version. Hardcoded creds nextagent:nextagent and nEXtSCAnExTERNal; PoC curl public in report. Same report lists a hardcoded JWT key and stored XSS (not CVE-scoped here, may deserve own signals). Nothing marked verified: no vendor advisory.","cites":["https://github.com/tongcheng-security-team/NextScan/issues/50","https://vul.yulun.ac.cn/20261107/nextscan/","https://github.com/tongcheng-security-team/NextScan/releases"]}],"documents":[{"id":128967,"url":"https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-hardcoded-credentials-in-ns-admin-agent-and-external-apis","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":129191,"url":"https://github.com/tongcheng-security-team/NextScan/issues/50","title":"NextScan issue #50: Agent API Basic Auth credentials hardcoded","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":129190,"url":"https://vul.yulun.ac.cn/20261107/nextscan/","title":"NextScan Vulnerability Report (Wu Yulun)","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":129193,"url":"https://github.com/tongcheng-security-team/NextScan/releases","title":"NextScan releases (latest v1.2.0)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[{"type":"poc","url":"https://vul.yulun.ac.cn/20261107/nextscan/"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}