{"id":"CVE-2026-40063","kind":"vulnerability","aliases":["CVE-2026-40063"],"related":[],"title":"FUXA: unauthenticated HTTP request leaks information from scripts endpoint","description":"A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to an information leak. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.","summary":"FUXA, a web-based SCADA and HMI tool, exposes its /nodered/fuxa/scripts functionality to unauthenticated HTTP requests. A crafted request can make the server leak information, per the NVD description of version 1.3.2-2809.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fuxa","industrial-control","other","scada","self-hosted"],"not_affected_if":["not-exposed-to-network","other-version"],"how_to_check":"- Check the FUXA version in use; the affected version listed is `1.3.2-2809`.\n- Check whether the FUXA web interface is reachable from untrusted networks.","fix":null,"status":"open","published_at":"2026-10-29T04:18:36+00:00","first_seen_at":"2026-10-29T04:41:58+00:00","triaged_at":"2026-10-29T04:43:08+00:00","updated_at":"2026-10-29T04:43:08+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-29T04:43:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FUXA: unauthenticated HTTP request leaks information from scripts endpoint","impact":"low","summary":"FUXA, a web-based SCADA and HMI tool, exposes its /nodered/fuxa/scripts functionality to unauthenticated HTTP requests. A crafted request can make the server leak information, per the NVD description of version 1.3.2-2809.","audience":"businesses","category":"other","nicknames":[],"who_cares":["fuxa","scada","industrial-control","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker reads information leaked by the server","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-40063 for the exact leaked data and for a fixed FUXA version.","how_to_check":"- Check the FUXA version in use; the affected version listed is `1.3.2-2809`.\n- Check whether the FUXA web interface is reachable from untrusted networks.\n- unknown for any other check, as the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["not-exposed-to-network","other-version"],"who_is_affected":"FUXA instances reachable over HTTP, most likely industrial or building control deployments where FUXA is used as a SCADA or HMI front end. Instances that are not network-reachable by untrusted parties are lower exposure. The sources do not say whether authentication settings change the outcome beyond the unauthenticated request described.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":4130,"output_tokens":588,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-2809':58B,73C '-40063':12A,15A '/nodered/fuxa/scripts':36B,66C '1.3.2':57B,72C 'attack':86C 'base':29B 'control':19B 'craft':43B,76C 'cve':10A,13A 'descript':54B 'disclosur':61C 'endpoint':9A 'exist':63C 'expos':34B 'function':37B,67C 'fuxa':1A,16B,25B,69C 'hmi':32B 'host':24B 'http':3A,40B,77C,91C 'industri':18B 'industrial-control':17B 'inform':6A,50B,60C,83C 'lead':80C 'leak':5A,49B,84C 'make':46B,88C 'nvd':53B 'per':51B 'request':4A,41B,44B,78C,92C 'scada':21B,30B 'script':8A 'self':23B 'self-host':22B 'server':48B 'special':75C 'tool':33B 'trigger':94C 'unauthent':2A,39B,90C 'version':56B,70C 'vulner':62C,96C 'web':28B 'web-bas':27B","nicknames":[],"mitigations":[],"who_affected":"FUXA instances reachable over HTTP, most likely industrial or building control deployments where FUXA is used as a SCADA or HMI front end. Instances that are not network-reachable by untrusted parties are lower exposure. The sources do not say whether authentication settings change the outcome beyond the unauthenticated request described.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T04:18:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-40063","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40063","severity":null,"published_at":"2026-10-29T04:18:36+00:00","modified_at":"2026-10-29T04:18:36+00:00","first_seen_at":"2026-10-29T04:41:58+00:00","fetched_at":"2026-10-29T04:41:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}