CVE-2026-72586: frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler
A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events (DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, etc.) call isSocketAdminAuthorized to verify the connection token, but the DAQQUERY handler in server/runtime/index.js lacks this check entirely.
Other sources
A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events (DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, etc.) call isSocketAdminAuthorized() to verify the connection token, but the DAQQUERY handler in server/runtime/index.js lacks this check entirely.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
frangoteam/FUXAto a version that resolves this vulnerability.Fixed in 1.3.3 - Configuration
Ensure secureEnabled is set to true, since other sensitive Socket.IO handlers enforce isSocketAdminAuthorized when secureEnabled=true; then apply the equivalent authorization check to the DAQ_QUERY Socket.IO event handler in server/runtime/index.js.
FUXA (Socket.IO) secureEnabled = true - Compensating control
Until DAQ_QUERY is fixed, prevent unauthenticated access to the Socket.IO DAQ_QUERY surface (e.g., restrict/disable external network access to the Socket.IO endpoint or DAQ_QUERY-capable service) so only authenticated/admin-authorized clients can reach it.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72586?
CVE-2026-72586 has a severity rating of high with a score of 7.5.
How do I fix CVE-2026-72586?
To fix CVE-2026-72586, implement proper authentication mechanisms for the DAQ_QUERY Socket.IO event handler.
What systems are affected by CVE-2026-72586?
CVE-2026-72586 affects versions up to 1.3.3 of frangoteam/FUXA.
Can CVE-2026-72586 be exploited remotely?
Yes, CVE-2026-72586 can be exploited by unauthenticated remote attackers.
What data can be accessed due to CVE-2026-72586?
CVE-2026-72586 allows attackers to query all historical sensor data.