What happened
Attackers are exploiting CVE-2026-58115, a missing authentication flaw in the Node-RED HTTP interface, to run arbitrary code on exposed servers. Siemens disclosed it on 11 Aug after finding it in SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. It carries a CVSS score of 10.0.
Node-RED is a low-code, flow-based programming tool built on Node.js. It runs on small devices like the Raspberry Pi, in the cloud, and embedded in commercial ICS/OT products. Without adminAuth set, the HTTP interface lets anyone reach the programming nodes that execute system commands.
Two built-in node types make the attack trivial. An inject node fires a message on a schedule or at startup. An exec node runs a shell command. Wire one to the other and the flow runs a command the moment it is deployed, with no further interaction.
On 30 Oct, a VulnCheck canary caught a complete exploit: a single POST /flows that deployed a flow, triggered it automatically, and pulled a binary from an attacker server, all behind three layers of encoding. The flow downloaded a file named bot-linux-amd64, saved it under a hidden name in a memory-backed location, and ran it in the background.
Timeline
- 11 Aug 2026: Siemens discloses CVE-2026-58115, CVSS 10.0.
- 30 Oct 2026: First in-the-wild exploit caught by a VulnCheck canary.
- 30 Oct to 1 Nov: Same IP hits Node-RED 16 times, delivering bots and persistent webshells.
- 1 Nov: VulnCheck warns publicly and adds the flaw to its KEV catalog.
Am I affected?
You are at risk if you run Node-RED anywhere that is reachable from outside your network and adminAuth is not configured. That includes cloud instances, Raspberry Pi deployments, and Node-RED embedded in ICS/OT products.
Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED, in versions before V4.3.4.1, are vulnerable. Version 4.3.4.1 and later contain patches.
The attacks are opportunistic mass scanning. The source IP in Microsoft's network (geolocating to Brazil) logged 125 hits against 8 different CVEs across Apache Solr, Camunda, Gitea, MLflow, Traefik and Joomla, so this actor is sweeping for many flaws at once.
What to do now
- Check whether your Node-RED instance is reachable from outside your network today. Block port 1880 at the firewall if it does not need external access.
- Enable adminAuth on the editor and admin API. An instance without it is open to anyone who can reach it.
- On SIMATIC IoT2050 Advanced, update to V4.3.4.1 or later.
- Review all deployed flows for unexpected exec nodes or HTTP endpoints you did not create.
- Assume compromise if your instance was exposed. The in-memory bot is lost on reboot, but webshells survive a restart, so a reboot alone does not clean a compromised host.
How to hunt
- Check for binaries saved under hidden names in memory-backed locations such as /dev/shm, and for processes named to look like kernel worker threads.
- Look in your web server and Node-RED logs for POST /flows requests from unexpected sources.
- Review deployed flows for inject nodes wired to exec nodes, or for HTTP-in endpoints acting as webshells.
- Check outbound connections to the payload servers listed in VulnCheck's indicators of compromise.
- Watch for shell scripts fetched from external servers and files disguised as kernel threads.
What does not help
- Rebooting alone. The in-memory bot clears, but any webshells planted stay in place.
- Patching without enabling adminAuth. If the interface is still open with no authentication, the exploit path remains. CISA had not listed this in its own KEV catalog at the time of writing, so do not wait on that signal.
Sources
- Critical Node-RED Flaw Exploited in Attacks, SecurityWeek, 3 Nov
- Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115), Help Net Security, 3 Nov
