CVE-2026-25938 is a critical authentication bypass (CVSS 9.8) in FUXA, the web based SCADA, HMI and dashboard software. With the Node-RED plugin enabled, an unauthenticated remote attacker can run code on the server. Upgrade to FUXA 1.2.11. The record does not list it in CISA's KEV catalog, and the sources we read do not report exploitation.
What's affected
- FUXA 1.2.8 through 1.2.10
- Fixed in FUXA 1.2.11
- Only when the Node-RED plugin is enabled
The advisory says affected deployments are exposed even when secure mode is switched on (runtime.settings.secureEnabled set to true). It lists no workaround. Later advisories for FUXA exist as well, so move to the newest release rather than stopping at 1.2.11.
How to check if you're exposed
Find each FUXA instance, including ones that engineers stood up for a pilot. The version appears in the application and in its package or container tag. Then check whether the Node-RED plugin is enabled, since that is the condition for this flaw. An instance with the plugin off is not exposed to this particular issue, though you should still upgrade.
Next, find out whether the instance is reachable from outside the plant network. Industrial dashboards on public addresses are the worst case.
What to do now
- Upgrade FUXA to 1.2.11 at minimum, and ideally to the current release.
- If you cannot upgrade immediately, disabling the Node-RED plugin removes the condition this CVE needs. The advisory does not state that, it is our reasoning from its description.
- Remove direct internet exposure. Place FUXA behind a VPN or firewall, separate from business networks.
- Review the server for unexpected flows or changes and check logs for requests from unknown addresses.
- Rotate credentials and tokens that the FUXA host could read, if you suspect it was reachable while vulnerable.
Why it matters
CWE-290 is authentication bypass by spoofing and CWE-306 is missing authentication for a critical function. Both say the same thing from different angles: a check that should have stood in front of a powerful action did not hold. Node-RED is a flow based programming tool that can run code, so access to it is access to the server.
FUXA sits between people and industrial equipment. A host compromise in that position is not just an IT incident. It can put the connected process visibility and control at risk, which is why the CISA style guidance is to keep such systems off the internet and behind firewalls.
The score is 9.8 because the attack is remote, needs no account and no user interaction, and affects confidentiality, integrity and availability fully.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
My instance has secure mode on. Am I safe?
No. The advisory says affected deployments are exposed even with secure mode enabled.
Do I need Node-RED enabled to be affected?
Yes, that is the stated condition. Upgrade anyway, since the plugin may be turned on later.
Sources
- https://github.com/frangoteam/FUXA/security/advisories/GHSA-v4p5-w6r3-2x4f
- https://github.com/frangoteam/FUXA/releases/tag/v1.2.11
Last reviewed: 19 October 2026.
