Vulnerability Bulletins |
CVE-2026-126802 |
|
| Affected software | REDIS |
| NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details and the server token, and impersonate scan nodes via registration, heartbeat and logging endpoints. | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-126802 | |