CVE-2026-42922
Frangoteam: A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can mak
frangoteam Frangoteam
CVSS
9.8CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version yet
What fixes it
No source in this snapshot names a fixed version.
Reports 3
1 outlet mention it. Reports are not confirmation; each links to its source.
- @stemshop.bsky.social: 🚨 CVE-2026-42922 — CVSS 9.8 CRITICAL A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809).... 🔎 https://stemshop.top/cve/CVE-2Bluesky: CVE posts, 29 Oct 2026
- @cve.skyfleet.blue: CVE-2026-42922 - FUXA Authorization Bypass and Remote Code Execution CVE ID : CVE-2026-42922 Published : Oct. 29, 2026, 2:59 a.m. | 30 minutes ago Description : A authorization bypBluesky: CVE posts, 29 Oct 2026
- @stackflag.bsky.social: CVE-2026-42922 - frangoteam The Node-RED part of FUXA version 1.3.2-2809 can be triggered by an unauthenticated web request, allowing an attacker to run any code on the server. ThiBluesky: CVE posts, 29 Oct 2026
Description
A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
Text from CVE List
Affected versions 1
- Frangoteamaffected: 1.3.2-2809CVE List