CVE-2026-47719

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote unauthenticated attacker can make server/runtime/devices/httprequest/index.js call axios.get against arbitrary HTTP or HTTPS destinations, connect to reachable OPC UA or ODBC services, and receive results through the corresponding Socket.IO event. This read SSRF oracle can expose cloud instance metadata, internal administrative services, industrial endpoints, and ODBC data reachable from the FUXA host, including when secureEnabled is true. This issue is fixed in version 1.3.2.

• CWE-918

• https://github.com/frangoteam/FUXA/commit/7b2088eaae2be318d962dcba34bfc7a7f26837bd
• https://github.com/frangoteam/FUXA/pull/2344
• https://github.com/frangoteam/FUXA/releases/tag/v1.3.2
• https://github.com/frangoteam/FUXA/security/advisories/GHSA-w86f-rf9w-h3x6
• https://github.com/frangoteam/FUXA/security/advisories/GHSA-w86f-rf9w-h3x6

Published

Aug 18, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47713AnythingLLM is an application that turns pieces of content i…4.3
• CVE-2026-47714libheif is a HEIF and AVIF file format decoder and encoder. …6.1
• CVE-2026-47715Bugsink is a self-hosted error tracking tool. Prior to 2.2.0…3.1
• CVE-2026-47716Bugsink is a self-hosted error tracking tool. Prior to 2.2.0…3.1
• CVE-2026-47717FUXA is a web-based Process Visualization (SCADA/HMI/Dashboa…7.5
• CVE-2026-47718FUXA is a web-based Process Visualization (SCADA/HMI/Dashboa…5.5
• CVE-2026-4772Improper neutralization of input during web page generation …5.4
• CVE-2026-47720FUXA is a web-based Process Visualization (SCADA/HMI/Dashboa…5.3
• CVE-2026-47721FUXA is a web-based Process Visualization (SCADA/HMI/Dashboa…6.3
• CVE-2026-47722nebula-mesh is a self-hosted control plane for Slack Nebula …8.7
• CVE-2026-47723nebula-mesh is a self-hosted control plane for Slack Nebula …7.1
• CVE-2026-47724nebula-mesh is a self-hosted control plane for Slack Nebula …9.9