Read the docs
TI-2026-85248 Aliases CVE-2026-122028GHSA-7whf-44vm-5p2x

Information disclosure in NST Labs Tech Nstbrowser Local Agent API

Priority LOW 24CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-284.

Summary

NST Labs Tech Nstbrowser version 1.21.0 has an information disclosure flaw in the /agent/info file of its Local Agent API. The flaw exposes sensitive information to an unauthorized actor (CWE-200). A remote attacker without privileges can obtain this information, but user interaction is required. The exploit has been publicly disclosed.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

A vulnerability has been found in NST Labs Tech Nstbrowser 1.21.0. Affected by this vulnerability is an unknown functionality of the file /agent/info of the component Local Agent API. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

EPSS 0.0038 32nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
NST Labs TechNstbrowser1.21.0—No fix listedCNA
  • Nstbrowser VendorNST Labs Tech Affected 1.21.0 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:nst_labs_tech:nstbrowser:*:*:*:*:*:*:*:*——NST Labs Tech
  • cpe:2.3:a:nst_labs_tech:nstbrowser:*:*:*:*:*:*:*:* Versions — — ·NST Labs Tech

Remediation

The sources list no fixed version for Nstbrowser.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-122028
  2. 2026-11-05 Alias added: GHSA-7whf-44vm-5p2x

References

Exploit 1

Other 1

  • TI-2026-85243 NST Labs Tech Nstbrowser stopAllBrowsers denial of service CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences