VulnCheck says attackers are now exploiting CVE-2026-58115, a CVSS 10 bug in Node-RED, the low-code flow tool a lot of us run for home automation and that also ships inside industrial gear.
The details
- It’s missing authentication on the Node-RED HTTP interface. An attacker can deploy a flow that runs system commands, with no login.
- Siemens disclosed it in August after finding it in SIMATIC IoT2050 Advanced devices. Version 4.3.4.1 and later are patched.
- The first attack was seen October 30. It deployed a flow, ran it, and pulled down a Linux bot. By November 1 there were 15 more from the same source, some dropping persistent webshells.
- Attackers are scanning for Node-RED instances without
adminAuthand exploiting them with a single HTTP request.
What I’d do
If you run Node-RED anywhere, make sure the editor isn’t reachable from the internet, turn on adminAuth, and look through your flows for exec nodes or HTTP endpoints you didn’t create.
God Bless, and Needs Garlic!
