CVE-2026-43946: FUXA Auth Bypass Vulnerability

CVE-2026-43946 Overview

CVE-2026-43946 is an authorization bypass vulnerability in FUXA, a web-based Process Visualization software used for SCADA, HMI, and dashboard applications. The flaw resides in the /api/getTagValue endpoint of FUXA version 1.3.0. When a request references a script that does not exist, the endpoint fails to enforce authorization and returns tag values to unauthenticated callers. The issue is tracked under CWE-863: Incorrect Authorization and is patched in version 1.3.1.

Critical Impact
Unauthenticated remote attackers can read industrial process tag values from exposed FUXA 1.3.0 instances, leaking sensitive operational technology (OT) data.

Affected Products

FUXA version 1.3.0 (web-based SCADA/HMI/Dashboard software by frangoteam)
Deployments exposing the /api/getTagValue endpoint to untrusted networks
Integrations relying on the Node-RED dashboard routing layer prior to the 1.3.1 fix

Discovery Timeline

2026-07-21 - CVE-2026-43946 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-43946

Vulnerability Analysis

FUXA exposes the /api/getTagValue REST endpoint to allow clients and scripts to query real-time SCADA tag values. The endpoint is expected to enforce authorization by either verifying admin permissions through the JWT layer or checking that the caller identifies a script authorized to read the requested tag via runtime.scriptsMgr.isAuthorisedByScriptName. In version 1.3.0, when the referenced sourceScriptName does not correspond to any existing script, the authorization check fails open. The server returns the tag values instead of rejecting the request, allowing unauthenticated data extraction from the underlying OT process.

Root Cause

The defect is a broken access control condition in server/api/command/index.js. The handler evaluates admin permission and script authorization but does not treat a missing script as a denial. The patch also tightens Node-RED integration routing in server/integrations/node-red/index.js, where a permissive URL substring match on /dashboard and /socket.io allowed request path manipulation to reach protected routes without authentication.

Attack Vector

Exploitation requires only network reach to the FUXA HTTP interface. An attacker sends a crafted GET request to /api/getTagValue with a sourceScriptName parameter referencing a nonexistent script. The server bypasses the authorization branch and returns the current tag value in the JSON response, disclosing live process data without credentials.

javascript

// Patched authorization check in server/api/command/index.js
if (res.statusCode === 403) {
    runtime.logger.error("api get getTagValue: Tocken Expired");
} else if (!authJwt.haveAdminPermission(permission) && !runtime.scriptsMgr.isAuthorisedByScriptName(req.query.sourceScriptName, permission)) {
-   res.status(400).json({error:"unauthorized_error", message: "Unauthorized!"});
+   res.status(401).json({error:"unauthorized_error", message: "Unauthorized!"});
    runtime.logger.error("api get getTagValue: Unauthorized");
} else {
    try {

Source: FUXA commit 78534da

javascript

// Tightened Node-RED route allowlist in server/integrations/node-red/index.js
const allowDashboard = (req, res, next) => {
    // Public dashboard UI and its HTTP APIs (served from httpNodeRoot/ui.path).
    // baseUrl comes from Express mount point and is not affected by query/path tricks.
    if (req.baseUrl === '/dashboard') return next();

    if (!settings.secureEnabled || settings.nodeRedAuthMode === 'legacy-open') {
        return next();

Source: FUXA Pull Request #2260

Detection Methods for CVE-2026-43946

Indicators of Compromise

Unauthenticated HTTP GET requests to /api/getTagValue returning HTTP 200 with tag data.
Repeated calls to /api/getTagValue with unusual or nonexistent values for the sourceScriptName query parameter.
FUXA application logs containing api get getTagValue: Unauthorized entries alongside successful 200 responses from the same client.
Access to /dashboard or /socket.io paths using suspicious query strings or encoded path traversal segments.

Detection Strategies

Deploy WAF or reverse-proxy rules that require authenticated sessions or API keys for all /api/* routes on FUXA hosts.
Correlate FUXA runtime logs with proxy access logs to identify requests where authorization failure messages coincide with 200 status responses.
Baseline expected sourceScriptName values used by legitimate scripts and alert on unknown identifiers.

Monitoring Recommendations

Monitor outbound egress from FUXA servers for anomalous connections that may follow reconnaissance of tag values.
Enable HTTP request logging on the FUXA reverse proxy and forward logs to a SIEM for retention and query.
Alert on any external network sources reaching FUXA API endpoints in OT environments that should be isolated.

How to Mitigate CVE-2026-43946

Immediate Actions Required

Upgrade FUXA to version 1.3.1 or later, which contains the authorization fix from GHSA-fwcm-rqvw-j3p7.
Remove FUXA management interfaces from public networks and restrict access to trusted OT/IT segments.
Rotate any API keys or tokens that may have been exposed alongside leaked tag data.
Review FUXA and reverse-proxy access logs for prior exploitation attempts against /api/getTagValue.

Patch Information

The fix is included in FUXA v1.3.1. The patch corrects the authorization branch in server/api/command/index.js to reject requests referencing nonexistent scripts and hardens the Node-RED integration allowlist in server/integrations/node-red/index.js to compare Express baseUrl rather than substring-matching the request URL. Details are available in the security advisory and commit 78534da.

Workarounds

Place FUXA behind an authenticating reverse proxy that enforces credentials on all /api/* paths until the upgrade is applied.
Block direct inbound access to the FUXA HTTP listener from any network outside the OT management segment.
Disable or firewall the Node-RED integration if it is not required for operations.

bash

# Example nginx snippet enforcing authentication in front of FUXA /api routes
location /api/ {
    auth_request /_auth;
    proxy_pass http://fuxa_backend;
}
location = /_auth {
    internal;
    proxy_pass http://auth_service/validate;
    proxy_set_header X-Original-URI $request_uri;
}