CVE-2026-67443
Received Received - Intake

Authentication Bypass in FUXA Node-RED Editor

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is true, and nodeRedAuthMode is secure, a remote unauthenticated attacker can obtain a signed guest token from POST /api/heartbeat and use it to access the RED.httpAdmin editor and flow deployment API. Because the Node-RED configuration has no second adminAuth gate, the attacker can deploy function nodes or invoke fuxa.runScript and runtime.scriptsMgr.runScript, gaining control of FUXA project data, configuration, scripts, filesystem-capable runtime helpers, and potentially operating-system commands when nodeRedUnsafeModules is enabled. This issue is fixed in version 1.3.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-19
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-67443
EUVD
EUVD-2026-61212

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
fuxa fuxa to 1.3.3 (exc)
fuxa fuxa 1.3.3
frangoteam fuxa 1.3.2
frangoteam fuxa 1.3.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FUXA versions 1.3.2 and earlier have a vulnerability where the Node-RED secure-mode authorization gate only verifies the JWT signature without checking the token's identity. This allows attackers to bypass authentication using a valid guest token obtained from the unauthenticated /api/heartbeat endpoint. The token can then be used to access the Node-RED editor and flow deployment API, enabling remote script execution and potential full system compromise.

Detection Guidance

Check if FUXA version is 1.3.2 or earlier. Inspect Node-RED configuration for nodeRedEnabled=true, secureEnabled=true, and nodeRedAuthMode=secure. Monitor for unauthorized access to /nodered/* endpoints or RED.httpAdmin editor. Look for unexpected script deployments or function node executions.

Impact Analysis

An attacker can gain unauthenticated remote code execution (RCE) with full access to the FUXA server process. They can deploy malicious flows, destroy project data, tamper with configurations, and cause denial of service. If nodeRedUnsafeModules is enabled, this escalates to arbitrary OS command execution as the FUXA service user.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. It enables unauthorized access to sensitive systems and data, which could result in data breaches under GDPR and HIPAA. The lack of proper authorization controls means organizations may fail to meet security and privacy standards.

Mitigation Strategies

Upgrade FUXA to version 1.3.3 or later. Disable Node-RED integration if not required. If Node-RED is needed, ensure nodeRedAuthMode is not set to secure and disable nodeRedUnsafeModules. Restrict network access to FUXA server and monitor for suspicious API calls to /api/heartbeat or /nodered endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67443. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart