Critical Node-RED Flaw Exploited in Attacks
Story 9, from SecurityWeek
A critical vulnerability in Node-RED (CVE-2026-58115) has been exploited in the wild to deploy payloads, including Linux bots and webshells. Vulnerability intelligence firm VulnCheck observed multiple attacks from Microsoft’s network.
Key points
- CVE-2026-58115 is a critical missing authentication flaw in Node-RED’s HTTP interface, allowing unauthenticated remote code execution.
- Siemens disclosed the vulnerability in its SIMATIC IoT2050 Advanced devices, which are patched in version 4.3.4.1 and later.
- VulnCheck observed successful in-the-wild exploitation on October 30, with attacks from an IP in Microsoft’s network.
- Attackers deployed encoded payloads, including Linux bots and persistent webshells, without checking installation success.
- Threat actors are actively scanning for Node-RED instances without adminAuth and exploiting them with a single HTTP request.
- VulnCheck advises checking if Node-RED is exposed to the internet and reviewing flows for suspicious exec nodes or HTTP endpoints.
Why it matters
This vulnerability is critical and has been actively exploited in the wild, affecting a wide range of systems, including industrial and embedded environments. The ease of exploitation and the presence of payloads for multiple architectures make it a high-priority issue for security teams.
Counterpoint
The vulnerability was disclosed by Siemens and patched in their devices, but the broader Node-RED ecosystem may still be at risk if not properly secured.
Sources
- Critical Node-RED Flaw Exploited in Attacks (SecurityWeek)
This summary was written by a language model and may contain errors. Read the original for the full story.