CVE-2026-25751 FUXA Unauthenticated Exposure of Plaintext Database Credentials
Unauthenticated attackers can retrieve plaintext database credentials from FUXA, enabling full access to historical process data and potential denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25751?
CVE-2026-25751 is a critical vulnerability in frangoteam FUXA, published on 6 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. Exploitation allows an unauthenticated, remote attacker to obtain the full system configuration, including administrative credentials for the InfluxDB database. Possession of these credentials may allow an attacker to authenticate directly to the database service, enabling them to read, modify, or delete all historical process data, or perform a Denial of Service by corrupting the database. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
Which versions are affected by CVE-2026-25751?
2 open source packages ship an affected version, including fuxa-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fuxa-server npm | All versions | 1.2.10 |
fuxa-server npm | All versions | 1.2.10 |
Products include Frangoteam Fuxa.
How do I fix CVE-2026-25751?
Upgrade fuxa-server to 1.2.10 or later.
Is CVE-2026-25751 being exploited?
There is no known exploitation of CVE-2026-25751 in the wild and no public exploit code.
Other vulnerabilities in frangoteam FUXA
- CVE-2026-25893 FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
- CVE-2025-69985 FUXA has JWT Authentication Bypass via HTTP Referer header spoofing
- CVE-2025-69971 FUXA has a hardcoded fallback JWT signing secret
- CVE-2023-31719 FUXA SQL Injection vulnerability
- CVE-2023-33831 A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA
Sources
Also known as GHSA-c5gq-4h56-4mmx.