CVE-2026-67443

creationtimestamp| type| source ---|---|--- 2026-08-18 21:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtf5gvi4ze2b 2026-08-18 22:08:28+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtfa5f6ln324 2026-08-20 03:00:03+00:00| published-proof-of-concept|...

CVE-2026-67443 FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is tru...