Critical Unauthenticated Exposure of Database Credentials in FUXA (fuxa-server)
Summary
GHSA-c5gq-4h56-4mmx: FUXA Unauthenticated Exposure of Plaintext Database Credentials. Affects fuxa-server versions < 1.2.10. Fixed in 1.2.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FUXA is an open-source application designed for managing and monitoring various processes. It provides a user-friendly interface and integrates with InfluxDB for data storage. The package, fuxa-server, is pivotal for its operation, allowing users to configure and manage their settings. However, a critical vulnerability has been identified that exposes sensitive database credentials, potentially compromising the entire system.
Vulnerability Detail
The vulnerability in FUXA allows an unauthenticated remote attacker to retrieve sensitive administrative database credentials. This issue arises from improper handling of configuration settings, which can be exploited even when secure settings are enabled. The ramifications include unauthorized access to the InfluxDB database, enabling attackers to read, modify, or delete data, or even cause a Denial of Service by corrupting the database. The vulnerability affects all deployments of FUXA up to version 1.2.9.
How To Fix
Latest published version: 1.1.14-1243 as of 23 Oct 2026
npm install fuxa-server@1.1.14-1243Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.10
This is the first release that contains the fix.
npm install fuxa-server@1.2.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version as soon as possible.
Conclusion
The FUXA vulnerability presents a serious risk to users by exposing sensitive database credentials. It is crucial to update to the latest version to mitigate this risk. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for fuxa-server →
FAQ
The vulnerability allows unauthorized access to sensitive database credentials, which can lead to data breaches.
You can check if your application is affected by using Vulert, which monitors vulnerabilities in real-time based on your package-lock.json.
Failure to address this vulnerability could result in unauthorized access to your database, leading to data loss or corruption.
Yes, the vulnerability affects all deployments regardless of whether secure settings are enabled.
You can use Vulert to monitor your projects for open-source vulnerabilities without needing to access the code directly.
References
Related vulnerabilities
Recent vulnerabilities recorded for fuxa-server.
