Is CVE-2026-126797 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126797 being exploited in the wild.

How severe is CVE-2026-126797?

Critical severity, with a CVSS score of 9.8, published 11 November 2026.

Which products and versions are affected?

Tongcheng-Security-Team NextScan 1.1.0 through 1.2.0.

Is there a fix for CVE-2026-126797?

Yes: fixed in . Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126797 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-126797?

Check whether you run Tongcheng-Security-Team NextScan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126797: NextScan authentication bypass in ns-admin via hardcoded JWT key

CVE-2026-126797 · Severity: critical · CVSS 9.8 · Published 2026-11-11

NextScan is a vulnerability scanning platform that manages security assessments, tasks, and results. An unauthenticated attacker can forge administrator credentials using a hardcoded JWT signing key embedded in the ns-admin component, gaining complete control over the platform including user management, scan configurations, and vulnerability data. This allows total compromise of the scanning infrastructure without legitimate credentials.

Technologies: Tongcheng-Security-Team NextScan. Vendors: Tongcheng-Security-Team.

Quick answers

Is CVE-2026-126797 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126797 being exploited in the wild.
How severe is CVE-2026-126797?: Critical severity, with a CVSS score of 9.8, published 11 November 2026.
Which products and versions are affected?: Tongcheng-Security-Team NextScan 1.1.0 through 1.2.0.
Is there a fix for CVE-2026-126797?: Yes: fixed in <UNKNOWN>. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126797 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-126797?: Check whether you run Tongcheng-Security-Team NextScan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: <UNKNOWN>

Technical details

NextScan 1.1.0 through 1.2.0 hardcodes a JWT signing key (nscan_admin_api_jwt_secret_key) in the ns-admin binary, allowing unauthenticated attackers to forge HS256 X-Access-Token headers with super administrator role claims. The vulnerability requires only network access to the ns-admin endpoint; no authentication or user interaction is needed. An attacker gains full administrative access to user management, scan tasks, and stored vulnerability results.

Affected products

tongcheng-security-team NextScan 1.1.0 through 1.2.0

Timeline

2026-11-07: disclosed
2026-11-11: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.