CVE-2026-42922: Critical severity FUXA FUXA vulnerability
Published Oct 29, 2026
·Updated
A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
Affected Software
1 affected component
FUXA FUXA=1.3.2-2809
Event History
Oct 29, 2026
CVE Published
via MITRE·02:59 AM
Data Sourced
via MITRE·02:59 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this vulnerability?
FUXA instances running version 1.3.2-2809 with the /nodered functionality reachable over HTTP are exposed. The issue can be triggered remotely over the network.
2
Does exploitation require authentication or user interaction?
No. An attacker can send a specially crafted unauthenticated HTTP request; no credentials or user interaction are required.
3
What could an attacker achieve?
Successful exploitation can result in arbitrary code execution. The reported impact includes high confidentiality, integrity, and availability impact.