{"id":"CVE-2026-42922","kind":"vulnerability","aliases":["CVE-2026-42922"],"related":[],"title":"FUXA: unauthenticated HTTP request to /nodered runs arbitrary code","description":"A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.","summary":"FUXA is a web-based SCADA and HMI visualization platform. A specially crafted unauthenticated HTTP request to its /nodered functionality bypasses authorization and can lead to arbitrary code execution on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FUXA","fixed":["1.3.3"],"affected":"<= 1.3.2","ecosystem":"npm"}],"ecosystems":[],"tags":["fuxa","hmi","industrial-control","node-red","other","scada","self-hosted"],"not_affected_if":["fixed-1.3.3","node-red-disabled","not-internet-exposed","other-versions"],"how_to_check":"Run FUXA 1.3.2 or earlier (Talos tested 1.3.2-2809)? Check settings: exposed only if Node-RED is enabled (nodeRedEnabled=true), secureEnabled=true and nodeRedAuthMode=\"secure\". Test: POST /api/heartbeat without credentials; if it returns a guest token and GET /nodered/ with that token in x-access-token returns 200 instead of 401, the instance is vulnerable. Fixed in 1.3.3.","fix":"Upgrade FUXA to 1.3.3 or later. The /nodered middleware then rejects guest and refresh JWTs and requires a non-guest authenticated user or a valid API key.","status":"open","published_at":"2026-10-29T04:18:36+00:00","first_seen_at":"2026-10-29T04:41:58+00:00","triaged_at":"2026-10-29T04:42:59+00:00","updated_at":"2026-10-29T04:44:51+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-29T04:42:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FUXA: unauthenticated HTTP request to /nodered runs arbitrary code","impact":"high","summary":"FUXA is a web-based SCADA and HMI visualization platform. A specially crafted unauthenticated HTTP request to its /nodered functionality bypasses authorization and can lead to arbitrary code execution on the server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["fuxa","scada","industrial-control","self-hosted","node-red"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary code on the FUXA server without logging in.","analyst_note":"Confirm affected version range and the fixed release from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-42922) and the FUXA project; sources give only one version.","how_to_check":"- Check whether the FUXA version in use is `1.3.2-2809`, the version named in the advisory.\n- Check whether the FUXA web interface, including the /nodered path, is reachable from untrusted networks.","plain_action":"","needs_analyst":true,"not_affected_if":["other-versions","not-internet-exposed"],"who_is_affected":"FUXA servers that expose the /nodered functionality are exposed to unauthenticated requests, so the team should look at any FUXA instance reachable from outside its network. The sources name only version 1.3.2-2809 and do not say which configurations are affected beyond that. Teams that do not run FUXA can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000706,"input_tokens":4128,"output_tokens":586,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm affected version range and the fixed release from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-42922) and the FUXA project; sources give only one version.","search":"'-2026':11A,14A '-2809':77C '-42922':12A,15A '/nodered':6A,49B,70C '1.3.2':76C 'arbitrari':8A,57B,87C 'attack':91C 'author':52B,64C 'base':35B 'bypass':51B,65C 'code':9A,58B,88C 'control':21B 'craft':43B,80C 'cve':10A,13A 'execut':59B,89C 'exist':67C 'function':50B,71C 'fuxa':1A,16A,17B,30B,73C 'hmi':18B,38B 'host':29B 'http':3A,45B,81C,96C 'industri':20B 'industrial-control':19B 'lead':55B,84C 'make':93C 'node':23B 'node-r':22B 'platform':40B 'red':24B 'request':4A,46B,82C,97C 'run':7A 'scada':26B,36B 'self':28B 'self-host':27B 'server':62B 'special':42B,79C 'trigger':99C 'unauthent':2A,44B,95C 'version':74C 'visual':39B 'vulner':66C,101C 'web':34B 'web-bas':33B","nicknames":[],"mitigations":[],"who_affected":"FUXA (SCADA/HMI) servers up to 1.3.2 that have the optional Node-RED integration enabled and are reachable by an attacker. Anyone can get a guest token from /api/heartbeat and use it on /nodered to deploy flows that run code in the FUXA process, with OS command execution if nodeRedUnsafeModules is on. Node-RED is off by default; installs without it, or on 1.3.3+, can skip this.","tier":"B","verified":{"fix":{"at":"2026-10-29T04:44:51Z","by":"analyst","doc":"https://github.com/frangoteam/FUXA/pull/2393","run_id":993},"how_to_check":{"at":"2026-10-29T04:44:51Z","by":"analyst","doc":"https://github.com/frangoteam/FUXA/pull/2393","run_id":993},"who_affected":{"at":"2026-10-29T04:44:51Z","by":"analyst","doc":"https://github.com/frangoteam/FUXA/pull/2393","run_id":993}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T04:18:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-42922","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42922","severity":null,"published_at":"2026-10-29T04:18:36+00:00","modified_at":"2026-10-29T04:18:36+00:00","first_seen_at":"2026-10-29T04:41:58+00:00","fetched_at":"2026-10-29T04:41:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-42922:993","url":null,"severity":null,"published_at":"2026-10-29T04:44:51+00:00","modified_at":"2026-10-29T04:44:51+00:00","first_seen_at":"2026-10-29T04:44:51+00:00","fetched_at":"2026-10-29T04:44:51+00:00","note":"Talos TALOS-2026-2419 (CVE-2026-42922) is the same guest-JWT /nodered bypass as GHSA-5h5x-9h7x-23f4 / CVE-2026-67443; fixed in 1.3.3 per vendor notes and PR 2393. Possible duplicate of CVE-2026-67443; code decides merge. No exploitation or PoC seen. Sibling Talos CVEs: CVE-2026-40063 (script name leak), CVE-2026-42949 (/api/runscript, fix pending next hotfix). Did not search social posts. Mitigation: enable Node-RED only on trusted networks."}],"documents":[{"id":14261,"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2419","title":"TALOS-2026-2419 FUXA /nodered authorization bypass (CVE-2026-42922)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":14262,"url":"https://github.com/frangoteam/FUXA/security/advisories/GHSA-5h5x-9h7x-23f4","title":"FUXA GHSA-5h5x-9h7x-23f4 guest JWT bypasses Node-RED gate (fixed 1.3.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":14263,"url":"https://github.com/frangoteam/FUXA/pull/2393","title":"FUXA PR 2393: strengthen Node-RED authorization","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}