NextScan: Hardcoded HTTP Basic Auth credentials (CVE-2026-126802)
NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in the AuthAgent and AuthExternal components, allowing unauthenticated access to APIs and sensitive configuration data.
CVE search metadata
CVE search record: CVE-2026-126802. Severity: high. CVSS: 8.2. KEV: no. Product: NextScan 1.1.0 through 1.2.0. Brief: NextScan: Hardcoded HTTP Basic Auth credentials (CVE-2026-126802). Brief link: https://feed.craftedsignal.io/briefs/2026-11-nextscan-hardcoded-credentials-cve-2026-126802/
Triage facts
Revision 1- Applicability
- NextScan 1.1.0 through 1.2.0
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 02:09 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers. This vulnerability allows unauthenticated attackers to access protected APIs.
Impact
Attackers can call /agent/config to obtain Redis passwords, etcd details, and the server token. Additionally, attackers can impersonate scan nodes via registration, heartbeat, and logging endpoints.
Recommendation
Review documentation for security updates or mitigations provided by the vendor regarding the hardcoded credentials in these versions.