An authorization bypass in the /nodered functionality of frangoteam's FUXA version 1.3.2-2809 lets an unauthenticated attacker run arbitrary code with a specially crafted HTTP request.
What Is It
CVE-2026-42922 is an authorization bypass vulnerability (CWE-285, Improper Authorization) in the /nodered functionality of FUXA. The NVD description says a specially crafted HTTP request can lead to arbitrary code execution, and that an attacker can trigger it with an unauthenticated HTTP request.
Talos ([email protected]) assigned the CVE and published it on 2026-10-29. Its NVD status is currently "Received", so NVD has not yet completed its own analysis.
Why It Matters
The CNA scored this flaw CVSS 3.1 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That vector means:
- Attackable over the network: an attacker can do this remotely.
- Easy to pull off: no special setup or timing is needed.
- No login needed: the attacker does not need an account.
- No user involvement: no one has to click or open anything.
- Severe damage if exploited: an attacker could read data on the system, change data or settings, and shut the system down or make it unusable.
Put simply, anyone who can reach an exposed /nodered endpoint on an affected instance may be able to take control of it without a password.
Exploitation status: This CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm that attackers are using it yet. Still, because it is easy to exploit and an attacker could take over the system, defenders should act on it now rather than waiting for the normal patch cycle.
What's Vulnerable
- Vendor: frangoteam
- Product: FUXA (listed as "Frangoteam" in the CNA's affected data)
- Affected version: 1.3.2-2809
- Affected component:
/noderedfunctionality
The CNA record sets the default status to "unaffected" and lists only version 1.3.2-2809 as affected. The NVD record does not include any CPE entries yet.
Patch Status
The supplied NVD record does not identify a fixed version or vendor patch. Because the CVE is not in KEV, there is also no CISA-mandated required action or due date.
Until fixed-version information is available, organizations running FUXA 1.3.2-2809 should:
- Check the Talos advisory and vendor channels for fix instructions.
- Restrict network access to FUXA instances, especially the
/noderedpath, so that untrusted networks cannot reach them.
Sources
- NVD – CVE-2026-42922
- Cisco Talos – TALOS-2026-2419
- CISA Known Exploited Vulnerabilities Catalog (this CVE is not listed)