Critical Node-RED Flaw Exploited to Deploy Linux Bots and Persistent Webshells
CVE-2026-58115 (CVSS 10/10) is a missing authentication flaw in the Node-RED HTTP interface that allows an unauthenticated remote attacker to create malicious flows and execute code with maximum privileges. VulnCheck reported successful exploitation on October 30 and, by November 1, 15 additional attacks from the same IP, delivering a Linux bot and persistent webshells. Check whether Node-RED is reachable from outside your network, enable adminAuth, and review flows for unexpected exec nodes.
What happened
VulnCheck reported successful attacks against a critical Node-RED flaw, a tool used in commercial products, including ICS/OT devices. The attacks came from a single IP address and deployed malicious payloads, including a Linux bot and persistent webshells.
Why it matters
A remote attacker, without any login, can run commands with maximum privileges on the server and take full control of the instance. According to VulnCheck, threat actors actively scan for instances without authentication and exploit them automatically with a single HTTP request.
What to do
Check today whether any Node-RED instance is reachable from outside your network and restrict that access. Enable authentication (adminAuth) and review deployed flows for unexpected exec nodes or HTTP endpoints.
For the technical team
- Affected
- Node-RED · Node-RED (low-code, flow-based programming tool used across sectors, including commercial ICS/OT devices). Siemens found the flaw in its SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed.
- Exploitation
- In-the-wild exploitation reported by VulnCheck: first successful attack observed on October 30; by November 1, 15 additional attacks from the same IP, in AS8075 (Microsoft's network), delivering a complete exploit, a Linux bot, and persistent webshells.
- Fix
- Siemens states SIMATIC IoT2050 Advanced version 4.3.4.1 and later contain patches. The source does not cite a fix for Node-RED itself. Mitigation cited by VulnCheck: enable adminAuth, block external access to Node-RED, and review deployed flows.
- Vector
- Node-RED HTTP interface lacking authentication (missing authentication). An unauthenticated remote attacker accesses programming nodes that can execute system commands. VulnCheck says instances without adminAuth are exploited automatically with a single HTTP request.
- More details
- According to VulnCheck, the exploit deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding. The execution command did not check whether installation succeeded; based on the file's name, the company believes the attackers built payloads for multiple architectures. Siemens disclosed the flaw on August 11.
Timeline
Initial entry: researchers report attacks exploiting the critical Node-RED flaw to deploy malicious payloads.
Sources 1 source
- Critical Node-RED Flaw Exploited in Attacks SecurityWeek
