CVE-2026-67443: FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is true, and nodeRedAuthMode is secure, a remote unauthenticated attacker can obtain a signed guest token from POST /api/heartbeat and use it to access the RED.httpAdmin editor and flow deployment API. Because the Node-RED configuration has no second adminAuth gate, the attacker can deploy function nodes or invoke fuxa.runScript and runtime.scriptsMgr.runScript, gaining control of FUXA project data, configuration, scripts, filesystem-capable runtime helpers, and potentially operating-system commands when nodeRedUnsafeModules is enabled. This issue is fixed in version 1.3.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FUXA (Node-RED integration)to a version that resolves this vulnerability.Fixed in 1.3.3 - Configuration
If possible, set nodeRedEnabled to false until fixed; the remote unauthenticated guest-token bypass occurs when nodeRedEnabled is true.
FUXA (Node-RED integration) nodeRedEnabled = true/false - Configuration
If you must keep nodeRedEnabled enabled, set nodeRedAuthMode to secure (secureEnabled and nodeRedAuthMode=secure are part of the vulnerable condition described) and ensure you are on FUXA version 1.3.3 or later.
FUXA (Node-RED integration) nodeRedAuthMode = secure - Compensating control
Restrict access to the RED.httpAdmin editor endpoints and the flow deployment API so unauthenticated clients cannot reach them (vulnerability allows access using a signed guest token from POST /api/heartbeat when conditions are met).
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments running FUXA 1.3.2 or earlier are exposed only when Node-RED is enabled and the configuration sets secureEnabled to true and nodeRedAuthMode to secure. The affected path is the Node-RED editor and flow deployment API at /nodered.
What does an attacker need to exploit this issue?
An attacker does not need an existing account or valid user credentials. They can obtain a signed guest token from POST /api/heartbeat and use it to pass the Node-RED authorization check.
What should be done if patching is not immediately possible?
Update FUXA to version 1.3.3. If updating cannot happen immediately, disable Node-RED to remove the affected access path; the issue requires nodeRedEnabled to be true.
How can I determine whether my instance may already be compromised?
Review whether unauthenticated requests to POST /api/heartbeat can obtain guest tokens and whether those tokens can access RED.httpAdmin or the Node-RED flow deployment API. Also check for unexpected Node-RED flows, especially function nodes or calls to fuxa.runScript and runtime.scriptsMgr.runScript.