---
id: "CVE-2026-126802"
page: "https://infrastack.ai/live/CVE-2026-126802"
kind: "vulnerability"
aliases: ["CVE-2026-126802"]
title: "NextScan 1.1.0\u20131.2.0: hardcoded agent API credentials (nextagent:nextagent) expose Redis password and server token"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "NextScan", "fixed": [], "affected": ">= 1.1.0, <= 1.2.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["docker", "hardcoded-credentials", "nextscan", "ns-admin", "other", "self-hosted"]
not_affected_if: ["network-restricted", "not-internet-exposed"]
published_at: "2026-11-11T21:16:43+00:00"
first_seen_at: "2026-11-11T21:29:08+00:00"
updated_at: "2026-11-11T21:32:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126802", "first_seen_at": "2026-11-11T21:29:08+00:00"}, {"source": "analyst", "url": "https://github.com/tongcheng-security-team/NextScan/issues/50", "first_seen_at": "2026-11-11T21:32:56+00:00", "cites": ["https://github.com/tongcheng-security-team/NextScan/issues/50", "https://github.com/tongcheng-security-team/NextScan/releases", "https://vul.yulun.ac.cn/20261107/nextscan/"]}]
exploit_sources: [{"type": "poc", "url": "https://vul.yulun.ac.cn/20261107/nextscan/"}]
---

# NextScan 1.1.0–1.2.0: hardcoded agent API credentials (nextagent:nextagent) expose Redis password and server token

Link for people: https://infrastack.ai/live/CVE-2026-126802 (this .md is for agents)

NextScan 1.1.0 through 1.2.0 ships hardcoded HTTP Basic Auth credentials in its ns-admin AuthAgent and AuthExternal routers. An unauthenticated attacker can call /agent/config to read Redis passwords, etcd details and the server token, and impersonate scan nodes.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NextScan affected >= 1.1.0, <= 1.2.0 fixed no fixed version listed

## How to check

Run NextScan 1.1.0, 1.1.1 or 1.2.0 (image lysec/ns-admin)? From a host that can reach ns-admin, run: curl -s -u nextagent:nextagent 'http://<host>/agent/config?group=2'. A JSON reply with Redis.Password and ServerToken means you are exposed. Also check whether ns-admin (default port 80) is reachable from untrusted networks.

## Fix

No fixed version known. The newest release listed is v1.2.0 (affected) and the maintainers' issue #50 is open. Until a fix ships, do not expose ns-admin to untrusted networks.

## Timeline

- 2026-11-11T21:29:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126802
- 2026-11-11T21:32:56+00:00 analyst https://github.com/tongcheng-security-team/NextScan/issues/50 — Read VulnCheck advisory, researcher report (vul.yulun.ac.cn) and GitHub issue #50 (open, no maintainer reply). Releases page shows v1.2.0 latest, no fixed version. Hardcoded creds nextagent:nextagent and nEXtSCAnExTERNal; PoC curl public in report. Same report lists a hardcoded JWT key and stored XSS (not CVE-scoped here, may deserve own signals). Nothing marked verified: no vendor advisory.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-hardcoded-credentials-in-ns-admin-agent-and-external-apis
- [advisory] NextScan issue #50: Agent API Basic Auth credentials hardcoded https://github.com/tongcheng-security-team/NextScan/issues/50
- [mentions] NextScan releases (latest v1.2.0) https://github.com/tongcheng-security-team/NextScan/releases
- [poc] NextScan Vulnerability Report (Wu Yulun) https://vul.yulun.ac.cn/20261107/nextscan/

## From the sources

NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details and the server token, and impersonate scan nodes via registration, heartbeat and logging endpoints.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_