Talos Vulnerability Report

Summary

A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to an information leak. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

Confirmed Vulnerable Versions

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

FUXA (version(s): 1.3.2-2809)

Product URLs

FUXA - https://github.com/frangoteam/FUXA

CVSSv3 Score

5.3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-200 - Information Exposure

Details

FUXA is an open-source, web based HMI software developed by frangoteam.

Users of the FUXA software can build virtual dashboards of physical processes, enabling them to read and write live process data, execute automations at the click of a button, review historical process data, interact remotely with physical devices, etc.

Generally, HTTP responses generated by FUXA apply some filtering to their content, limiting results to ‘sensitive’ information based on the requesting user and their associated permissions. This includes requests to /api/projects which, among other information, provides the client with metadata about certain ‘scripts’, ensuring it returns only information about scripts the requesting user is authorized to execute. This type of content filtering appears broadly throughout the standard /api/ route handlers.

One of the optional features of FUXA is to integrate an instance of Node-RED. By default, this is a disabled feature, and this vulnerability requires that Node-RED be enabled. To facilitate integration with Node-RED, FUXA exposes the Node-RED instance directly under the /nodered route, as well as some FUXA specific helpers. One such FUXA helper, accessed by HTTP GET request to /nodered/fuxa/scripts, implements a similar functionality to /api/projects as it relates to script metadata.

Requests destined for this helper route are handled in server/integrations/node-red/index.js. We include the relevant function below.

RED.httpAdmin.get('/fuxa/scripts', async function(req, res) {
    try {
    // [1] Fetch the raw project scripts directly from storage-backed project state
    const scripts = await runtime.project.getScripts();
    // [2] Return every script's id and name without authorization filtering
    const result = scripts ? scripts.map(script => ({ id: script.id, name: script.name })) : [];
    res.json(result);
    } catch (err) {
    res.status(500).json({ error: err.message });
    }
});

This handler first fetches the full script list by calling runtime.project.getScripts() (at [1]) and then maps the returned objects into a response containing id and name for every script in the project (at [2]). As noted, there is no additional authorization checks or filtering applied to the response.

We note here that access to children of /nodered must first traverse an authentication middleware which attempts to validate the JSON Web Token sent along with the request. This validation step is vulnerable to a second vulnerability (TALOS-2026-2419) which allows a user to mint a valid token and bypass this requirement. In its current state, as of version 1.3.2-2809, an unauthenticated or low-privilege user may bypass the standard account-level filtering and abuse the /nodered/fuxa/scripts route to leak the names and identifiers of all configured scripts on the system.

This information leak is particularly relevant due to a third vulnerability, documented as TALOS-2026-2417, which is an authorization bypass in FUXA which requires knowledge of a privileged script’s identifier and name.

Vendor Response (CVE-2026-40063)

Vendor Notes: Node-RED is an optional integration in FUXA and is disabled unless explicitly enabled by the deployment. We recommend enabling it only in trusted/internal environments with appropriate access controls. The v1.3.3 Node-RED authorization changes also reduce exposure by preventing unauthenticated guest-token access to Node-RED routes.

Timeline

2026-05-29 - Cisco - Vendor Notification
2026-06-08 - Cisco - Follow-up sent
2026-06-08 - Frangoteam - Vendor Acknowledged
2026-06-10 - Cisco - Follow-up sent
2026-06-23 - Cisco - Follow-up sent
2026-06-23 - Frangoteam - Vendor replied
2026-07-16 - Cisco - Follow-up sent
2026-07-22 - Frangoteam - Vendor replied
2026-09-15 - Cisco - Follow-up sent