A CVSS 10 Flaw in Node-RED Is Being Exploited With One HTTP Request. Do You Know Which of Your Devices Quietly Run It?

VulnCheck reports that attackers began exploiting CVE-2026-58115, a maximum-severity (CVSS 10.0) missing-authentication flaw in Node-RED, on 30 October 2026, using a single HTTP request to run commands on exposed servers. According to Help Net Security and SecurityWeek, the first hit landed on a VulnCheck decoy system, and the same source address tried the flaw 16 times by 1 November. Neither report gives a count of exposed instances.

The flaw

Node-RED is a low-code, flow-based tool for building event-driven applications. It is also embedded in commercial industrial products. Siemens disclosed CVE-2026-58115 in August 2026 (advisory SSA-834709): an unauthenticated remote attacker can create malicious flows and execute arbitrary code on the server with maximum privileges. Siemens lists the SIMATIC IoT2050 Advanced running Industrial OS with Node-RED as affected, fixed in V4.3.4.1 and later. The reports do not name affected or fixed upstream Node-RED releases.

What the attacker did

Per VulnCheck's observations:

• One request: a POST to /flows deployed a flow with three layers of encoding. An inject node triggered an exec node automatically, so the shell command ran on deployment.
• A Linux bot: the command downloaded bot-linux-amd64 from a separate server and ran it in the background from a memory-backed location. VulnCheck did not retrieve the binary, so its purpose is unknown.
• Webshells: later attempts delivered a shell script, a file disguised as a kernel worker thread, and webshells that survive a reboot. The bot itself is lost on restart unless it persists another way.
• Opportunistic scanning: the source IP sits in Microsoft's network and geolocates to Brazil. VulnCheck logged 125 hits from it across eight CVEs in products including Apache Solr, Camunda, Gitea, MLflow, Traefik and Joomla. This is mass scanning, not a targeted campaign.

The attacks look for Node-RED instances that have adminAuth disabled. CISA had not listed the flaw in its KEV catalog at the time of VulnCheck's report; VulnCheck's own KEV catalog has it.

What to check

1. Is Node-RED reachable from outside? This includes OT and lab networks that were never meant to face the internet but do.
2. Is adminAuth enabled on every Node-RED instance you run?
3. Review deployed flows for unexpected exec nodes or HTTP endpoints. VulnCheck notes some attackers leave webshells rather than a bot, so a clean process list is not proof of a clean host.
4. Patch affected Siemens devices to V4.3.4.1 or later.
5. Compare against the published indicators in VulnCheck's write-up, which lists the attacking IP and both payload servers.

Why this one is hard to inventory

The advisory was public for nearly three months before exploitation started. The gap that matters is not the patch, it is knowing where the software is. Node-RED rarely appears in a procurement record as "Node-RED"; it arrives inside an industrial gateway, an integration box a contractor installed, or a developer's side project. Teams that track servers and laptops can still have no list of what these devices expose.

How Obiguard Scout fits

Obiguard Scout approaches this from the outside, the way the scanners do. It enumerates the hosts and services your organisation publishes to the internet and records what it observes, so an unexpected Node-RED editor port on a gateway, or an HTTP interface that answers without authentication, shows up in your exposure list rather than in an incident report. That gives you the first thing the checklist above needs: the set of reachable candidates to verify. Scout sees only what is visible from outside; confirming adminAuth settings and reviewing flows still requires access to the device. For a similar "known but unfound" exposure story, see our GitLab and Alpine analysis. You can run a free Scout check on a domain you own to see what is already published under it.

Sources

• Help Net Security: Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)
• SecurityWeek: Critical Node-RED Flaw Exploited in Attacks