SECURITYCRITICALCVE-2026-42922

CVE-2026-42922: FUXA SCADA/HMI /nodered Authorization Bypass Allows Unauthenticated Code Execution

An authorization bypass in FUXA's /nodered route lets an unauthenticated HTTP request run arbitrary code. FUXA 1.3.2-2809 is affected; v1.3.3 fixes it.

Dylan H.

Security Team

October 29, 2026
3 min read
CVE-2026-42922: FUXA SCADA/HMI /nodered Authorization Bypass Allows Unauthenticated Code Execution

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • FUXA 1.3.2-2809 (fixed in 1.3.3)

CVE-2026-42922: Unauthenticated Code Execution in FUXA's Node-RED Integration

Cisco Talos disclosed CVE-2026-42922 (TALOS-2026-2419) on 2026-10-29: an authorization bypass in the /nodered functionality of FUXA, the open-source web-based SCADA/HMI and dashboard software. A specially crafted, unauthenticated HTTP request can lead to arbitrary code execution. NVD lists a CVSS score of 9.8.

The vendor fixed the issue in FUXA v1.3.3.

Vulnerability Overview

AttributeValue
CVE IDCVE-2026-42922
CVSS Score9.8 (Critical) per NVD
TypeAuthorization bypass leading to code execution
Affected SoftwareFUXA (frangoteam)
Affected Version1.3.2-2809
Fixed Version1.3.3
AuthenticationNone required
AdvisoryTALOS-2026-2419

Technical Analysis

Requests to /nodered pass through FUXA's allowDashboard authorization callback, which only requires a valid, signed JWT. Guest tokens and refresh tokens satisfy that check, so access to the Node-RED editor cannot be restricted by identity. Node-RED allows flows to execute arbitrary JavaScript and system commands, so reaching the editor equals code execution on the host.

The v1.3.3 fix makes the /nodered middleware reject guest JWTs and refresh tokens and require an authenticated non-guest user or a valid API key.

This is distinct from CVE-2026-25893, an earlier Node-RED integration RCE in FUXA 1.2.8 through 1.2.10 (patched in 1.2.11), but it shares many characteristics with it. FUXA has had repeated authentication problems in this integration.

Exploitation Status

VulDB reports no public exploit at disclosure, but describes exploitation as easy. ICS/HMI software exposed to the internet is a frequent scanning target, so treat exposed instances as high risk.

Remediation

  1. Upgrade FUXA to v1.3.3 or later.
  2. Do not expose FUXA to the internet. Place it behind a VPN or an authenticating reverse proxy.
  3. Restrict /nodered at the proxy to trusted administrator IP ranges until patched.
  4. Review Node-RED flows for unfamiliar nodes (exec, function, HTTP-in) and check the host for unexpected processes or outbound connections.
  5. Rotate secrets stored in FUXA or Node-RED, including device credentials and API keys.
# Docker deployments: confirm the running version, then pull the fixed image
docker exec fuxa cat package.json | grep '"version"'
docker pull frangoteam/fuxa:latest

Key Takeaways

  1. CVE-2026-42922 gives unauthenticated attackers code execution on FUXA hosts through the /nodered route.
  2. FUXA 1.3.2-2809 is affected; 1.3.3 fixes it.
  3. SCADA/HMI web interfaces should never sit directly on the internet.
  4. This is the second Node-RED integration auth flaw in FUXA this year, so review exposure even after patching.

Sources