Platform
nodejs
Component
fuxa-server
Fixed in
1.2.11
1.2.10
CVE-2026-25751 describes an information disclosure vulnerability within the FUXA server, allowing unauthenticated remote attackers to retrieve sensitive administrative database credentials. This vulnerability impacts all versions of FUXA up to 1.2.9. A patch addressing this issue is available in version 1.2.10.
The impact of CVE-2026-25751 is severe. Successful exploitation allows an attacker to obtain the full system configuration of the FUXA server, including the credentials for the underlying InfluxDB database. With these credentials, an attacker can authenticate and gain complete control over the database, potentially leading to data breaches, data manipulation, and further system compromise. This vulnerability is particularly concerning as it requires no authentication, making it easily exploitable by a wide range of attackers. The runtime.settings.secureEnabled setting does not mitigate this vulnerability.
CVE-2026-25751 was publicly disclosed on 2026-02-05. The vulnerability's simplicity and the potential for significant impact suggest a medium probability of exploitation (EPSS score likely medium). No public proof-of-concept exploits have been observed as of this writing, but the ease of exploitation makes it a likely target for opportunistic attackers. This vulnerability is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.01% (1% percentile)
CISA SSVC
The primary mitigation for CVE-2026-25751 is to immediately upgrade FUXA Server to version 1.2.10 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting network access to the FUXA server to only trusted sources. While not a complete solution, this can reduce the attack surface. Monitor InfluxDB logs for any suspicious authentication attempts. After upgrading, confirm the fix by attempting to access the administrative database credentials through a standard HTTP request; the response should not reveal any sensitive information.
Actualice FUXA a la versión 1.2.10 o posterior. Esta versión corrige la vulnerabilidad de divulgación de credenciales de la base de datos. La actualización se puede realizar descargando la nueva versión desde el sitio web del proveedor y siguiendo las instrucciones de instalación.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-25751 is a critical vulnerability in FUXA Server allowing unauthenticated attackers to retrieve sensitive database credentials, potentially leading to full system compromise.
If you are running FUXA Server versions prior to 1.2.10, you are vulnerable to this information disclosure vulnerability.
Upgrade FUXA Server to version 1.2.10 or later to remediate this vulnerability. Restrict network access as a temporary workaround.
While no public exploits have been confirmed, the ease of exploitation suggests a potential for active exploitation.
Refer to the official FUXA project website or GitHub repository for the latest security advisories and release notes.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.