Skip to content
Threat Feed
Subscribe
critical advisory

FUXA: Authorization bypass and remote code execution (CVE-2026-42922)

An authorization bypass vulnerability in the /nodered endpoint of FUXA 1.3.2-2809 allows unauthenticated attackers to execute arbitrary code via specially crafted HTTP requests.

CVE search metadata

CVE search record: CVE-2026-42922. Severity: critical. CVSS: 9.8. KEV: no. Product: FUXA (1.3.2-2809). Brief: FUXA: Authorization bypass and remote code execution (CVE-2026-42922). Brief link: https://feed.craftedsignal.io/briefs/2026-10-fuxa-rce/

Triage facts

Revision 1
Applicability
FUXA (1.3.2-2809)
Evidence
Unknown
Severity
Critical
Action
Elevated
Sources
1 public source
Freshness
Revision 1Oct 29, 05:03 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

CVE-2026-42922 describes a critical vulnerability in FUXA version 1.3.2-2809. The flaw resides in the /nodered functionality, where missing authorization controls allow an unauthenticated attacker to submit crafted HTTP requests, resulting in arbitrary code execution. No vendor patch information or remediation details were provided at the time of the NVD disclosure.

Impact

Successful exploitation allows for unauthenticated remote code execution on the server hosting the FUXA application, which can lead to full system compromise.

Recommendation

  • Inventory all instances of FUXA 1.3.2-2809 within the environment.
  • Implement strict network access controls to restrict access to the /nodered endpoint to trusted management IP addresses only.
  • Monitor web server access logs for anomalous requests directed at the /nodered path.
  • Prioritize the deployment of updates as soon as the vendor releases a patched version.

Immediate actions

Inventory FUXA assets and restrict access to the /nodered endpoint.

IT Operations 24h

Threat Hunt

Identify unauthorized access attempts to /nodered in web server logs.

T1190 high high confidence hunt now

Data: Web server access logs

Mitigations

Isolate vulnerable FUXA instances from the public internet.

immediate IT Operations

CVE-2026-42922

Detection coverage 1

Detect CVE-2026-42922 Exploitation - Unauthenticated Access to /nodered

critical

Detects potential exploitation attempts of CVE-2026-42922 by monitoring for HTTP requests to the /nodered endpoint.

sigma tactics: execution, initial_access techniques: T1059, T1190 sources: webserver

Detection queries are available on the platform. Get full rules →