2026-10-29
Unauthenticated HTTP requests to the /nodered endpoint of FUXA 1.3.2-2809 can bypass authorization and reach a code-execution path, giving a network attacker high impact to confidentiality, integrity, and availability (CVSS 9.8). The vulnerable component is FUXA's Node-RED integration endpoint; the supplied intelligence does not identify a CISA KEV designation or public exploit code at time of analysis, while the vuln.today priority decision is act_now. Internet-exposed or broadly reachable FUXA deployments that expose /nodered should therefore be treated as urgent exposure, whereas strictly segmented instances are less directly reachable.
Authenticated users with script create or edit rights in openEQUELLA deployments before 2026.1 can achieve arbitrary OS command execution through the scripting engine's system.execute() function, which runs supplied operating system commands with no validation or allow-list of permitted executables. Commands execute with the privileges of the openEQUELLA service account, so a content-manager or administrator-level script author can pivot from application control to full host compromise, with high confidentiality, integrity, and availability impact and scope change beyond the vulnerable component. The vendor has released 2026.1 as the complete fix, and the issue is tracked as act_now priority; no public exploit code or confirmed active exploitation is identified in the available data, and the practical limiting factor is the privileged script permission required rather than unauthenticated reachability.