PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-67443 frangoteam CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. CVE-2026-67443 is a critical vulnerability in FUXA 1.3.2 and earlier versions. The vulnerability exists in the allowDashboard authorization gate in server/integrations/node-red/index.js, where the decoded identity is not inspected when nodeRedEnabled is true, secureEnabled is true, and nodeRedAuthMode is secure. This oversight allows remote unauthenticated attackers to obtain a signed guest token via POST /api/heartbeat. The attackers can then use this token to access the RED.httpAdmin editor and flow deployment API. Consequently, they can deploy function nodes or invoke fuxa.runScript and runtime.scriptsMgr.runScript, potentially gaining control of FUXA project data, configuration, scripts, filesystem-capable runtime helpers, and possibly operating-system commands if nodeRedUnsafeModules is enabled. The issue is addressed in version 1.3.3. Organizations using FUXA 1.3.2 or earlier, particularly those in industrial control systems or SCADA environments, should be aware of this critical vulnerability and take immediate action to mitigate the risk. This includes operators of FUXA deployments, platform administrators, vulnerability management teams, and security personnel responsible for monitoring and defending against potential threats. Evidence from the NVD and CVE.org confirms the existence of CVE-2026-67443 in FUXA 1.3.2 and earlier. The CVE record and NVD entry provide details on the vulnerability's impact and affected versions. Organizations should verify their deployments and review configurations for potential exposure, focusing on Node-RED settings and the use of nodeRedUnsafeModules. Defensive measures should include monitoring for suspicious activity related to Node-RED function nodes and script execution.

Vendor
frangoteam
Product
FUXA
CVSS
CRITICAL 9.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-18
Original CVE updated
2026-09-09
Advisory published
2026-08-18
Advisory updated
2026-09-09

Who should care

Organizations using FUXA 1.3.2 or earlier, especially those in industrial control systems or SCADA environments, should be aware of this critical vulnerability and take immediate action to mitigate the risk. This includes operators of FUXA deployments, platform administrators, vulnerability management teams, and security personnel responsible for monitoring and defending against potential threats.

Technical summary

CVE-2026-67443 is a critical vulnerability in FUXA 1.3.2 and earlier. The allowDashboard authorization gate in server/integrations/node-red/index.js fails to inspect the decoded identity when nodeRedEnabled is true, secureEnabled is true, and nodeRedAuthMode is secure. This allows remote unauthenticated attackers to obtain a signed guest token and access the RED.httpAdmin editor and flow deployment API, potentially gaining control of FUXA project data, configuration, scripts, and filesystem-capable runtime helpers.

Defensive priority

Organizations using FUXA 1.3.2 or earlier should prioritize immediate defensive actions due to the critical severity of this vulnerability.

Recommended defensive actions

  • Immediately upgrade to FUXA version 1.3.3 or later
  • Restrict access to the RED.httpAdmin editor and flow deployment API
  • Monitor for suspicious activity related to Node-RED function nodes and script execution
  • Review and limit the use of nodeRedUnsafeModules
  • Implement additional authentication and authorization measures for Node-RED
  • Conduct a thorough review of current Node-RED configurations and deployments
  • Verify that all FUXA project data and configurations are properly secured

Evidence notes

Evidence from the NVD and CVE.org confirms the existence of CVE-2026-67443 in FUXA 1.3.2 and earlier. The CVE record and NVD entry provide details on the vulnerability's impact and affected versions. Organizations should verify their deployments and review configurations for potential exposure, focusing on Node-RED settings and the use of nodeRedUnsafeModules. Defensive measures should include monitoring for suspicious activity related to Node-RED function nodes and script execution.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-67443 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-67443

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-67443 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-67443

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.