Executive brief
FUXA is an open-source industrial automation and SCADA visualization platform that includes integration with Node-RED for advanced workflow automation. An authentication bypass vulnerability allows unauthenticated attackers to send malicious requests to the Node-RED API endpoint, execute arbitrary code with FUXA service privileges, and potentially compromise connected industrial control systems. This poses severe risk to manufacturing facilities, power grids, and other critical infrastructure.
Technical details
FUXA versions 1.2.8 through 1.2.10 contain an authentication bypass (CWE-290, CWE-306) in the Node-RED plugin that allows unauthenticated remote attackers to craft requests to the /nodered/flows endpoint. The vulnerability bypasses security checks including those when runtime.settings.secureEnabled is enabled, granting full administrative access to the Node-RED API. Attackers can submit malicious flow configurations to execute arbitrary code in the FUXA service context. The attack requires only network access and no user interaction; exploitation may lead to full system compromise, data exfiltration, and lateral movement into connected ICS/SCADA environments. A patch is available in version 1.2.11.
Affected products
- Frango Team FUXA 1.2.8 through 1.2.10
Timeline
- 2026-02-09: disclosed: Security advisory published
- 2026-02-10: patched: FUXA 1.2.11 released with fix