CVE-2026-40063 in Frangoteam
Summary
by MITRE • 10/29/2026
A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to an information leak. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/29/2026
The identified security flaw resides within the /nodered/fuxa/scripts endpoint of FUXA, a web-based industrial automation software platform, specifically affecting versions 1.3.2 through 2809. This vulnerability is classified as an information disclosure issue, which falls under the broader category of CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The core technical flaw stems from insufficient access control mechanisms on this specific API endpoint. Because the functionality does not enforce authentication or authorization checks before processing incoming HTTP requests, it allows any remote actor with network connectivity to interact directly with internal scripting components without valid credentials. This lack of enforcement represents a fundamental failure in implementing proper security controls for sensitive system interfaces, aligning closely with CWE-862: Missing Authorization and CWE-359: Exposure of Private Personal Information if the scripts expose user-specific data or operational secrets.
The operational impact of this vulnerability is significant within industrial control systems where FUXA is deployed. An unauthenticated attacker can craft specific HTTP requests to trigger the leakage of internal system information. This may include sensitive configuration details, script logic that reveals proprietary automation processes, database connection strings, or other metadata critical for understanding the architecture and security posture of the target environment. In an industrial context, such exposure provides adversaries with valuable reconnaissance data that facilitates further attacks, including privilege escalation, lateral movement, or targeted exploitation of known weaknesses in exposed services. This aligns with MITRE ATT&CK technique T1087: Account Discovery and potentially T1592: Gather Victim Host Information, as the leaked information aids in mapping the attack surface for subsequent malicious activities.
To mitigate this vulnerability, immediate remediation should focus on enforcing strict authentication requirements on all administrative and internal API endpoints within FUXA. The /nodered/fuxa/scripts functionality must be configured to require valid session tokens or credentials before any processing occurs. Additionally, implementing role-based access control ensures that only authorized administrators can interact with scripting modules. It is also recommended to apply the latest security patches provided by the vendor for versions 1.3.2-2809 and above, as these updates typically include fixes for such access control deficiencies. For environments where immediate patching is not feasible, network-level controls such as firewall rules or reverse proxy configurations should be employed to restrict direct external access to this endpoint, allowing it only from trusted internal subnets with additional authentication layers in place.