Critical Node-RED Flaw Exploited in Attacks

What it is

CVE-2026-58115 (CVSS 10) is a missing-authentication flaw in the Node-RED HTTP interface. Siemens disclosed it on 11 August 2026 after finding it in SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. VulnCheck reported exploitation in the wild on Sunday 1 November 2026.

How it works

An unauthenticated remote attacker can reach Node-RED's programming nodes, which can execute system commands. Siemens says this allows creating malicious flows and running arbitrary code on the underlying server with maximum privileges.

In the first attack seen on 30 October, one HTTP request deployed a flow, triggered it automatically, and pulled a binary from an attacker-controlled server. VulnCheck says the whole chain sat behind three layers of encoding. The payload was a Linux bot. The execution command did not check whether installation succeeded. From the file name, VulnCheck believes the attackers built payloads for several architectures.

By 1 November, the same AS8075 (Microsoft) IP had made 15 more attacks. Some left persistent webshells instead of bots, which allow arbitrary command execution.

Preconditions / Affected

• Node-RED instances running without adminAuth that are reachable by the attacker. VulnCheck says attackers are scanning for these and exploiting them automatically.
• SIMATIC IoT2050 Advanced devices on Industrial OS with Node-RED. Version 4.3.4.1 and later contain the patch.
• Node-RED is also embedded in other commercial ICS/OT products. The page does not list them or give their patch status.

What to do

• Check today whether any Node-RED instance, including ones embedded in ICS/OT devices, can be reached from outside your network.
• Set adminAuth on instances that lack it.
• On SIMATIC IoT2050 Advanced, upgrade to 4.3.4.1 or later.
• Review deployed flows for unexpected exec nodes or unexpected HTTP endpoints. Webshells may be present even where no bot was found.

Caveats

The page gives no indicators of compromise beyond the AS8075 source address, and no file names, hashes or detection queries. Attribution to a specific actor is not stated. The exploitation figures come from VulnCheck's own observations.