NextScan vulnerabilities

2 known vulnerabilities in NextScan from Tongcheng-security-team. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  NextScan: Use of Hard-coded Credentials

  CVE-2026-126802Nov 11, 2026Tongcheng-security-team

  NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details

• 9.8 Critical severity

  NextScan: Use of Hard-coded Cryptographic Key

  CVE-2026-126797Nov 11, 2026Tongcheng-security-team

  NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super