CVE-2026-126802: NextScan 1.1.0 through 1.2.0 Hardcoded Credentials in ns-admin Agent and External APIs
NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details and the server token, and impersonate scan nodes via registration, heartbeat and logging endpoints.
Event History
Frequently Asked Questions
Which deployments are affected?
NextScan versions 1.1.0 through 1.2.0 are affected. The issue is in the ns-admin AuthAgent and AuthExternal routers.
What can an unauthenticated remote attacker do?
An attacker can access protected APIs using the hardcoded HTTP Basic Auth credentials. They can call /agent/config to retrieve Redis passwords, etcd details, and the server token.
Can this be used to impersonate scan infrastructure?
Yes. The exposed server token can be used with registration, heartbeat, and logging endpoints to impersonate scan nodes.