CVE-2026-42922 Details
Description
A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
An authorization bypass vulnerability has been identified in Frangoteam FUXA version 1.3.2-2809, specifically within the Node-RED integration accessible via the '/nodered' route. This vulnerability allows for arbitrary code execution through a specially crafted HTTP request. The issue arises because the authorization callback intended to validate access does not properly restrict permissions, enabling unauthorized users to access Node-RED and execute malicious flows that could run arbitrary commands on the device.
Users can upgrade to FUXA version 1.3.3, which addresses this vulnerability by rejecting guest JWTs and refresh tokens, and requiring an authenticated non-guest user or a valid API key to access the Node-RED integration.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://talosintelligence.com/vulnerability_reports/TALOS-2026-2419 | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| frangoteam FUXA | 1.3.2-2809 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |