CVE-2026-40063: FUXA information disclosure in Node-RED scripts endpoint

CVE-2026-40063 · Severity: medium · CVSS 5.3 · Published 2026-10-29

FUXA is an open-source web-based HMI software that allows operators to build dashboards and remotely interact with industrial processes. When Node-RED integration is enabled, an unauthenticated attacker can retrieve the names and identifiers of all configured scripts on the system through the /nodered/fuxa/scripts endpoint, bypassing normal authorization controls. This information disclosure can enable subsequent attacks on privileged scripts, potentially leading to unauthorized control of industrial systems.

Technologies: Frangoteam FUXA. Vendors: Frangoteam.

Quick answers

Is CVE-2026-40063 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40063 being exploited in the wild.
How severe is CVE-2026-40063?
Medium severity, with a CVSS score of 5.3, published 29 October 2026.
Which products and versions are affected?
Frangoteam FUXA 1.3.2-2809.
Is there a fix for CVE-2026-40063?
Yes: fixed in 1.3.3. Until then: Disable Node-RED integration unless required for internal/trusted environments only, and ensure appropriate network-level access controls are in place to restrict access to the /nodered routes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40063 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-40063?
Check whether you run Frangoteam FUXA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 1.3.3

Disable Node-RED integration unless required for internal/trusted environments only, and ensure appropriate network-level access controls are in place to restrict access to the /nodered routes.

Technical details

The /nodered/fuxa/scripts GET endpoint in server/integrations/node-red/index.js fetches all project scripts and returns their identifiers and names without authorization filtering, despite similar endpoints in the main /api/ routes applying permission-based content filtering. An unauthenticated attacker can make an HTTP request to retrieve this information, which is particularly dangerous when combined with authorization bypass vulnerabilities (TALOS-2026-2417, TALOS-2026-2419) that allow script execution abuse. The vulnerability requires Node-RED to be enabled, which is disabled by default.

Affected products

  • frangoteam FUXA 1.3.2-2809

Timeline

  • 2026-10-29: disclosed
  • 2026-10-29: advisory: Cisco Talos TALOS-2026-2418

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.