Managing self-hosted scanning machines with a Cloud instance - Port Swigger
Summary: PortSwigger's documentation describes managing scanning pools for self-hosted Burp Scanner machines from a cloud instance, noting that self-hosted scanning machines update automatically. It states that an authentication token can only be revoked when no scans are active on the machines using it, and that machines using a revoked token show as Disconnected.
Bottom line: Token revocation is blocked while scans are running, so a credential you want to cut off stays live until every active scan on those machines finishes - a window an attacker or a departing insider could sit inside.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026