Is CVE-2026-25938 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25938 being exploited in the wild.

How severe is CVE-2026-25938?

Medium severity, with a CVSS score of 4, published 10 February 2026.

Which products and versions are affected?

fuxa-server (npm) SEMVER:introduced=1.2.8,fixed=1.2.11.

Is there a fix for CVE-2026-25938?

Yes. fuxa-server (npm): upgrade to 1.2.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25938 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-25938?

Check whether you run fuxa-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25938: FUXA authentication bypass in Node-RED integration

CVE-2026-25938 · Severity: medium · CVSS 4 · Published 2026-02-10

FUXA is an open-source industrial automation and SCADA visualization platform that includes integration with Node-RED for advanced workflow automation. An authentication bypass vulnerability allows unauthenticated attackers to send malicious requests to the Node-RED API endpoint, execute arbitrary code with FUXA service privileges, and potentially compromise connected industrial control systems. This poses severe risk to manufacturing facilities, power grids, and other critical infrastructure.

Technologies: fuxa-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-25938 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25938 being exploited in the wild.
How severe is CVE-2026-25938?: Medium severity, with a CVSS score of 4, published 10 February 2026.
Which products and versions are affected?: fuxa-server (npm) SEMVER:introduced=1.2.8,fixed=1.2.11.
Is there a fix for CVE-2026-25938?: Yes. fuxa-server (npm): upgrade to 1.2.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25938 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-25938?: Check whether you run fuxa-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fuxa-server (npm): upgrade to 1.2.11 or later
```
npm install fuxa-server@1.2.11
```

Technical details

FUXA versions 1.2.8 through 1.2.10 contain an authentication bypass (CWE-290, CWE-306) in the Node-RED plugin that allows unauthenticated remote attackers to craft requests to the /nodered/flows endpoint. The vulnerability bypasses security checks including those when runtime.settings.secureEnabled is enabled, granting full administrative access to the Node-RED API. Attackers can submit malicious flow configurations to execute arbitrary code in the FUXA service context. The attack requires only network access and no user interaction; exploitation may lead to full system compromise, data exfiltration, and lateral movement into connected ICS/SCADA environments. A patch is available in version 1.2.11.

Affected products

Frango Team FUXA 1.2.8 through 1.2.10

Identifiers

CVE-2026-25938
GHSA-v4p5-w6r3-2x4f

Timeline

2026-02-09: disclosed: Security advisory published
2026-02-10: patched: FUXA 1.2.11 released with fix

References

https://github.com/frangoteam/FUXA/security/advisories/GHSA-v4p5-w6r3-2x4f

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.