CVE-2026-72586: FUXA Auth Bypass Vulnerability

CVE-2026-72586 Overview

CVE-2026-72586 is a missing authentication vulnerability [CWE-306] affecting the frangoteam/FUXA supervisory control and data acquisition (SCADA) platform through version 1.3.3. The flaw resides in the DAQ_QUERY Socket.IO event handler within server/runtime/index.js. Unlike other sensitive Socket.IO events that invoke isSocketAdminAuthorized to validate the connection token, the DAQ_QUERY handler omits this check entirely. An unauthenticated remote attacker can query all historical sensor data collected by the platform, exposing operational technology telemetry.

Critical Impact
Unauthenticated remote attackers can exfiltrate all historical sensor and process data from FUXA instances, even when secureEnabled=true is configured.

Affected Products

frangoteam/FUXA versions up to and including 1.3.3
Deployments configured with secureEnabled=true
Any FUXA instance exposing the Socket.IO endpoint to untrusted networks

Discovery Timeline

2026-08-10 - CVE-2026-72586 published to the National Vulnerability Database
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72586

Vulnerability Analysis

FUXA is a web-based process visualization and SCADA/HMI platform used to monitor industrial devices and sensors. The application uses Socket.IO for real-time client-server communication. When secureEnabled=true is set, the server enforces authentication on sensitive events by calling isSocketAdminAuthorized to verify the client's connection token. This gate protects events such as DEVICE_BROWSE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST.

The DAQ_QUERY event handler, defined in server/runtime/index.js, does not invoke the authorization function. A network-reachable attacker can open a Socket.IO connection without credentials and emit DAQ_QUERY requests to retrieve historical data acquisition records. The response returns stored sensor readings, timestamps, and tag values from the FUXA data historian.

Root Cause

The root cause is a missing authorization check on a specific event handler. Developers applied isSocketAdminAuthorized consistently to most sensitive Socket.IO events but omitted it from the DAQ_QUERY branch. This inconsistency defeats the intent of the secureEnabled configuration flag. The pattern maps directly to CWE-306: Missing Authentication for Critical Function.

Attack Vector

Exploitation requires network access to the FUXA Socket.IO endpoint. No credentials, user interaction, or elevated privileges are required. An attacker establishes a Socket.IO client session and emits a DAQ_QUERY event with parameters selecting the desired tags and time range. The server responds with historical values because the handler skips token validation. Confidentiality is fully impacted; integrity and availability are not affected by this specific issue. Refer to the FUXA source file for the affected handler location.

Detection Methods for CVE-2026-72586

Indicators of Compromise

Socket.IO connections to the FUXA server that emit DAQ_QUERY events without a preceding authenticated handshake
Unusual volume of historical data queries originating from unknown or external IP addresses
Access log entries showing Socket.IO polling or WebSocket upgrades from clients that never authenticate

Detection Strategies

Instrument server/runtime/index.js or a reverse proxy to log every DAQ_QUERY event alongside the associated session token and source IP
Correlate Socket.IO session identifiers with prior admin login events to identify unauthenticated data pulls
Alert on outbound data volumes from the FUXA host that exceed baseline operator activity

Monitoring Recommendations

Forward FUXA application logs and reverse proxy access logs to a centralized analytics platform for retention and correlation
Monitor for repeated Socket.IO connections from the same source enumerating tag identifiers
Track FUXA process network egress and flag connections to non-operator IP ranges

How to Mitigate CVE-2026-72586

Immediate Actions Required

Restrict network access to the FUXA Socket.IO endpoint using firewall rules, allowing only trusted operator workstations
Place FUXA behind an authenticating reverse proxy that terminates Socket.IO traffic and enforces client authentication
Audit stored historian data to determine what sensor information may have been exposed

Patch Information

At the time of publication, no fixed release is referenced in the NVD entry. Monitor the frangoteam/FUXA GitHub repository for updates to server/runtime/index.js that add an isSocketAdminAuthorized call to the DAQ_QUERY handler. Apply the patched release as soon as it is published.

Workarounds

Block the FUXA Socket.IO port at the perimeter and expose the application only through a VPN or zero-trust network gateway
Deploy a reverse proxy rule that drops Socket.IO frames containing the DAQ_QUERY event name from unauthenticated sessions
Segment FUXA hosts on an isolated operational technology network with strict east-west access controls

bash

# Example nginx rule to require an authenticated upstream session before proxying Socket.IO traffic
location /socket.io/ {
    auth_request /auth;
    proxy_pass http://fuxa_backend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}