VulnSocial

CVE-2026-42922

LOWCVSS 9.8 · CRITICAL

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-285

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 3 mentions across 1 observed day

What's happening

  • 3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-10-29: 310-29
Referenced assets2 URLs
Full discourse3 posts
  • Parameter Watch@ParameterWatch

    ⚠️ CVE-2026-42922 (9.8) ⚠️ FUXA lets anyone who can reach its /nodered endpoint run commands on the server without logging in. FUXA 1.3.2-2809 is affected. No fixed version has been named yet. https://t.co/xDdQwh9eJC

    1000028
    21 followersView on X
  • ThreatAft@ThreatAft

    🔐FUXA SCADA: CVSS 9.8, no auth needed. /nodered checks the JWT signature. Never reads who it belongs to. Guest token from heartbeat passes the gate. 4th auth bypass in 2026. Same integration every time. https://threataft.com/articles/fuxa-cve-2026-42922-nodered-auth-bypass-rce #SCADA #ICS #CVE #InfoSec

    0000028
    52 followersView on X
  • cve.now@cvedotnow

    🔴 Frangoteam: auth bypass in Node-RED leads to code execution (CVE-2026-42922) An unauthenticated attacker can send a crafted HTTP request to run arbitrary code on the affected system. No patch listed yet https://cve.now/CVE-2026-42922

    00000470
    7.3K followersView on X

Explore more

Back to dashboard