CVE-2026-43947: FUXA SCADA RCE Vulnerability Explained

CVE-2026-43947 Overview

FUXA is a web-based Supervisory Control and Data Acquisition (SCADA), Human Machine Interface (HMI), and dashboard visualization platform. Version 1.3.0 contains an unauthenticated Remote Code Execution (RCE) vulnerability in the POST /api/runscript endpoint when secureEnabled is set to true. The endpoint validates authorization against a stored script's permission by ID, but when the request body includes test: true, it compiles and executes attacker-supplied code instead of the stored script. This flaw is categorized as an authorization weakness [CWE-863]. Version 1.3.1 remediates the issue.

Critical Impact
Unauthenticated attackers can execute arbitrary code on FUXA servers by combining a separately reported information disclosure in GET /api/project with the test mode bypass in /api/runscript.

Affected Products

FUXA version 1.3.0 (frangoteam/FUXA)
Deployments with secureEnabled set to true
Any FUXA project containing at least one server-side script

Discovery Timeline

2026-07-21 - CVE-2026-43947 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-43947

Vulnerability Analysis

The vulnerability resides in FUXA's /api/runscript command handler. When authentication is enabled, the endpoint enforces authorization by looking up the referenced script ID and checking whether the caller has permission to execute that specific script. This authorization check is applied to the stored script object, not to the code actually executed.

When the request payload includes test: true, the handler branches into a test execution path. In this branch, the server compiles and runs the code contained in the request body rather than the code persisted in the project. The permission check remains bound to the referenced script's metadata, so the attacker inherits execution rights without owning the code that runs. The result is arbitrary code execution under the FUXA server process.

Root Cause

The root cause is an authorization decision that references the wrong object. FUXA authorizes access based on the stored script identified by ID, then executes attacker-controlled code from the request body. This mismatch between the authorized resource and the executed payload constitutes a broken access control condition [CWE-863].

Attack Vector

An unauthenticated attacker first calls GET /api/project, which discloses script IDs and names without authentication in the vulnerable release. The attacker then issues a POST /api/runscript request that references a valid script ID and name, sets test: true, and supplies arbitrary JavaScript in the request body. The FUXA runtime compiles and executes the supplied code. The only prerequisite is that at least one server-side script exists in the project and is accessible without restrictive permissions.

javascript

// Patch excerpt: server/api/command/index.js
// The upstream fix corrects the HTTP status returned on unauthorized access
// and is part of the broader authorization hardening in commit 78534da.
if (res.statusCode === 403) {
    runtime.logger.error("api get getTagValue: Tocken Expired");
} else if (!authJwt.haveAdminPermission(permission) && !runtime.scriptsMgr.isAuthorisedByScriptName(req.query.sourceScriptName, permission)) {
    res.status(401).json({error:"unauthorized_error", message: "Unauthorized!"});
    runtime.logger.error("api get getTagValue: Unauthorized");
} else {
    try {
// Source: https://github.com/frangoteam/FUXA/commit/78534da61a91613712b44bb63c8d7da8c5df5ca4

Detection Methods for CVE-2026-43947

Indicators of Compromise

HTTP POST requests to /api/runscript containing "test": true in the JSON body from unauthenticated or unexpected clients.
Preceding unauthenticated GET /api/project requests enumerating project metadata and script identifiers.
Unexpected child processes, outbound network connections, or file writes originating from the FUXA Node.js runtime.
FUXA process spawning shells (sh, bash, cmd.exe, powershell.exe) outside normal operational patterns.

Detection Strategies

Inspect reverse proxy and web server access logs for /api/runscript POSTs correlated with prior /api/project GETs from the same source.
Alert on FUXA runtime processes executing operating system commands, reading credential files, or establishing new outbound sockets.
Enable request body logging on the FUXA API layer to capture payloads containing the test flag for forensic review.

Monitoring Recommendations

Monitor SCADA and HMI hosts for process lineage anomalies where Node.js spawns interactive shells or scripting interpreters.
Track authentication failures and 401 responses against /api/runscript after upgrading, which may indicate scanning activity.
Baseline outbound network traffic from operational technology (OT) segments and alert on deviations that could indicate post-exploitation.

How to Mitigate CVE-2026-43947

Immediate Actions Required

Upgrade FUXA to version 1.3.1 or later, which contains the fix delivered in pull request #2260 and commit 78534da.
Restrict network access to the FUXA management interface using firewalls, VPN, or reverse proxy allowlists until patching is complete.
Audit existing FUXA projects and remove or lock down server-side scripts that are not strictly required.
Review authentication logs and system telemetry for signs of exploitation predating the upgrade.

Patch Information

The fix is delivered in FUXA v1.3.1. Refer to the GitHub Security Advisory GHSA-rg3m-cfq7-g6h6, the GitHub Pull Request #2260, the GitHub Commit 78534da, and the GitHub Release v1.3.1 for full remediation details.

Workarounds

Place FUXA behind a reverse proxy that blocks POST requests to /api/runscript from untrusted sources until the patch is applied.
Remove all server-side scripts from the FUXA project, which eliminates the precondition required for exploitation.
Segment FUXA hosts from general corporate networks and restrict management access to a dedicated administrative VLAN.

bash

# Example nginx reverse proxy rule to block unauthenticated runscript access
location = /api/runscript {
    if ($http_authorization = "") { return 403; }
    proxy_pass http://fuxa_backend;
}

# Example upgrade steps for a containerized deployment
docker pull frangoteam/fuxa:1.3.1
docker stop fuxa && docker rm fuxa
docker run -d --name fuxa -p 1881:1881 frangoteam/fuxa:1.3.1