GitHub Advisoryadvisory · npm

GHSA-c5gq-4h56-4mmx FUXA Unauthenticated Exposure of Plaintext Database Credentials

CRITICAL Published 2026-02-05 Modified 2026-02-06 Official page ↗
Aliases
CVE-2026-25751
Ecosystem
npm
Packages
fuxa-server
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Weaknesses
CWE-306, CWE-312
Reviewed
2026-02-05

Affected packages

• npm fuxa-server: < 1.2.10 → fixed in 1.2.10

Description

Description An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10. Impact This affects all deployments, including those with `runtime.settings.secureEnabled` set to `true`. Exploitation allows an unauthenticated, remote attacker to obtain the full system configuration, including administrative credentials for the InfluxDB database. Possession of these credentials may allow an attacker to authenticate directly to the database service, enabling them to read, modify, or delete all historical process data, or perform a Denial of Service by corrupting the database. Patches This issue has been patched in FUXA version 1.2.10. Users are strongly encouraged to update to the latest available release.

Related

Alias · CVE (1)

  • CVE-2026-25751 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. vulnerability

Weakness · CWE (2)

  • CWE-306 Missing Authentication for Critical Functionality weakness
  • CWE-312 Cleartext Storage of Sensitive Information weakness

References