CVE-2026-67443: FUXA Auth Bypass Vulnerability

CVE-2026-67443 Overview

CVE-2026-67443 is a missing authorization vulnerability [CWE-862] in FUXA, a web-based Process Visualization (SCADA/HMI/Dashboard) platform. Versions 1.3.2 and earlier fail to inspect the decoded identity when gating access to the embedded Node-RED editor. A remote unauthenticated attacker can request a signed guest token from POST /api/heartbeat, present it to /nodered, and reach the RED.httpAdmin editor and flow deployment API. From there, the attacker can deploy function nodes or invoke fuxa.runScript and runtime.scriptsMgr.runScript to control project data, scripts, and the underlying runtime. The issue is fixed in version 1.3.3.

Critical Impact
Unauthenticated remote attackers can deploy arbitrary Node-RED flows against exposed FUXA instances, achieving code execution and potential operating-system command execution when nodeRedUnsafeModules is enabled.

Affected Products

FUXA versions 1.3.2 and earlier
Deployments where nodeRedEnabled is true, secureEnabled is true, and nodeRedAuthMode is set to secure
Instances where nodeRedUnsafeModules is enabled (elevated OS command execution risk)

Discovery Timeline

2026-08-18 - CVE-2026-67443 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-67443

Vulnerability Analysis

The flaw lives in server/integrations/node-red/index.js, which enforces the allowDashboard authorization gate for the /nodered route. That gate calls authJwt.verify but never inspects the decoded identity returned by the token. Any valid signature passes, including tokens minted for the guest role.

FUXA exposes POST /api/heartbeat to unauthenticated callers and returns a signed guest JWT. An attacker can request this token and immediately replay it against /nodered. Node-RED is mounted without a second adminAuth gate, so the editor and flow deployment API are reachable once the outer gate is passed.

Once inside, an attacker can deploy function nodes, invoke fuxa.runScript, or call runtime.scriptsMgr.runScript. This yields control of FUXA project data, configuration, scripts, and filesystem-capable runtime helpers. If nodeRedUnsafeModules is enabled, the attacker can load Node modules capable of issuing operating-system commands.

Root Cause

The root cause is a missing authorization check [CWE-862]. The verification callback discards the decoded token payload, so guest identities receive the same access as authenticated operators.

Attack Vector

The attack is network-reachable, requires no authentication, and requires no user interaction. An attacker only needs HTTP access to the FUXA server and a running Node-RED integration.

javascript

// Security patch in server/api/jwt-helper.js
// Fix: node-red authorization GHSA-5h5x-9h7x-23f4 (#2393)
  */
 function verify (token) {
     return new Promise ((resolve, reject) => {
-        jwt.verify(token, secretCode, (err, decoded) => {
+        jwt.verify(token, secretCode, (err) => {
             if (err) {
                 console.error(`verify token error: ${err}`);
                 reject(false);

Source: FUXA commit e0b553c. The patch is one component of the broader fix in Pull Request #2393, which introduces identity-aware checks before granting access to /nodered.

Detection Methods for CVE-2026-67443

Indicators of Compromise

Unexpected POST /api/heartbeat requests from external addresses immediately followed by requests to /nodered or /nodered/flows.
New or modified Node-RED flow definitions containing function nodes that reference fuxa.runScript, runtime.scriptsMgr.runScript, or child_process.
Unexpected spawning of shell processes (sh, bash, cmd.exe, powershell.exe) as children of the FUXA or Node.js process.
Modifications to FUXA project files, scripts, or configuration made outside operator working hours.

Detection Strategies

Inspect reverse proxy and application logs for unauthenticated access to /nodered/* endpoints, especially POST /nodered/flows.
Alert on JWT issuance from /api/heartbeat followed by privileged Node-RED admin API calls within a short time window.
Baseline the set of Node-RED flows and alert when new function nodes are deployed on production HMI instances.

Monitoring Recommendations

Forward FUXA, Node.js, and reverse proxy logs to a central data lake for correlation across authentication and admin API activity.
Monitor process ancestry on the host running FUXA to catch runtime helpers spawning interactive shells.
Track outbound connections from the FUXA host to identify command-and-control activity following flow deployment.

How to Mitigate CVE-2026-67443

Immediate Actions Required

Upgrade FUXA to version 1.3.3 or later, which introduces identity inspection on the /nodered authorization gate.
If patching is not immediate, remove FUXA from any network segment reachable by untrusted clients.
Rotate the JWT signing secret after patching to invalidate any guest tokens already issued to attackers.
Audit Node-RED flows for unauthorized function nodes or references to fuxa.runScript and runtime.scriptsMgr.runScript.

Patch Information

The fix is available in FUXA release v1.3.3. Technical details are documented in GitHub Security Advisory GHSA-5h5x-9h7x-23f4 and implemented in Pull Request #2393.

Workarounds

Disable the Node-RED integration by setting nodeRedEnabled to false until the upgrade is complete.
Ensure nodeRedUnsafeModules is disabled to remove the direct path to operating-system command execution.
Restrict access to the FUXA web interface with network ACLs, VPN, or an authenticating reverse proxy.
Place an external adminAuth-equivalent authentication layer in front of /nodered routes.

bash

# Example: block external access to the Node-RED admin route at a reverse proxy
# nginx snippet
location /nodered/ {
    allow 10.0.0.0/8;      # internal operator network only
    deny  all;
    proxy_pass http://127.0.0.1:1881/nodered/;
}