Node-RED Flaw CVE-2026-58115 Exploited: Lock Down the Editor

The Node-RED flaw CVE-2026-58115 is now being exploited. Security research firm VulnCheck caught the first attack on October 30, 2026, aimed at Node-RED editors reachable without a login. With a single HTTP request, the attacker deploys a flow that runs commands on the server. The flaw carries a CVSS score of 10.0, the maximum on the scale.

What happened to Node-RED

Node-RED is a flow-based programming tool originally developed at IBM and now hosted by the OpenJS Foundation. Users build programs by wiring together blocks, called nodes, in a browser-based editor. Because it is lightweight and runs on inexpensive hardware such as the Raspberry Pi, it is widely used to connect sensors, machines, and monitoring dashboards.

Siemens first disclosed CVE-2026-58115 in advisory SSA-834709 on August 11, 2026. The advisory covers the SIMATIC IoT2050 Advanced industrial gateway running Industrial OS with Node-RED installed. According to Siemens, these devices do not enforce authentication on the Node-RED HTTP interface. Someone without an account can therefore reach nodes capable of running system commands, create malicious flows, and execute code with the highest privileges. Siemens scored the flaw 10.0 under both CVSS 3.1 and CVSS 4.0.

For almost three months there were no reports of exploitation. That changed in late October. VulnCheck released detection for the flaw on October 27, 2026, and its canary network caught the first in-the-wild attack three days later. The firm published its findings on November 2, and SecurityWeek reported on them the following day.

How the attack works

The attacker sends one POST /flows request to the Node-RED editor. It contains a simple flow: an inject node that immediately triggers an exec node, so the system command runs without anyone clicking anything. The command is hidden behind three layers of base64 encoding.

That command downloads a Linux bot, saves it as a hidden file in memory, and starts it in the background. VulnCheck logged 16 events from the same IP address against this flaw between October 30 and November 1, 2026, carrying several different payloads. In later variants the attacker stopped installing bots and planted webshells instead: flows with an http in node wired to an exec node, so any command can be sent through a web address.

The attacking IP sits on Microsoft’s network (AS8075). VulnCheck says the same address probed 8 different vulnerabilities in recent days, including flaws in Apache Solr, Gitea, and Joomla. That pattern points to opportunistic scanning, with the attacker hunting for any exposed service rather than a specific target.

Which installations to check

The Siemens advisory names only one product: SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2), all versions below V4.3.4.1 running Industrial OS with Node-RED installed. Siemens strongly recommends updating to V4.3.4.1 or later.

The underlying problem is wider than one device. VulnCheck writes that Node-RED instances without adminAuth are being found and exploited automatically. adminAuth is the setting that requires a login before anyone can open the editor and change flows.

The official Node-RED documentation states that the editor is not secured by default: anyone who can reach its IP address can open the editor and deploy changes. The uiHost setting also listens on all IPv4 interfaces (0.0.0.0) on port 1880 by default, according to the Node-RED configuration page. A Node-RED instance installed as-is on a server with a public address can therefore be reached straight from the internet.

VulnCheck also notes that Node-RED is embedded in commercial ICS/OT products, the control systems that run factories and industrial sites. Emerson’s documentation, for example, mentions Node-RED, although VulnCheck has not confirmed whether Emerson products are affected. Owners of industrial equipment that ships with Node-RED should ask their vendor directly about its status.

When VulnCheck published its report, the flaw was in VulnCheck’s own KEV catalog but not yet in the Known Exploited Vulnerabilities catalog run by CISA, the US cybersecurity agency. For system administrators the catalog status changes little, since exploitation has already been observed.

Why editors without a login are targeted

Node-RED is built to be easy. In a few minutes a technician can connect a temperature sensor to a dashboard or send an alert when a machine stops. The same ease applies to attackers: the exec node ships with the editor, so anyone who can open the editor can also run commands on the server.

In industrial settings, Node-RED often runs on gateways that bridge production machines with the office network or the cloud. Such gateways are frequently installed once and left running for years without review. When the editor is exposed to the internet, that server can become a foothold for moving deeper into the plant network. A similar pattern appeared in the case of hacked supermarket fridges in France, which were reached through internet-connected refrigeration systems.

The bot used in this campaign has not been analyzed, because VulnCheck did not retrieve the binary. Even so, any server already running foreign code should be treated as compromised.

What this means for factories and IoT teams

Node-RED shows up in many places in Indonesia, from factories monitoring production lines and buildings controlling air conditioning to farms tracking soil moisture and university labs. IT teams and technicians can work through the following steps today, in order of urgency.

Find every Node-RED instance

List every server, gateway, and Raspberry Pi running Node-RED, including those installed by vendors or for old projects. Check whether the editor port (1880 by default) can be reached from outside the network, for example by trying to open it over a mobile connection.

Block access from the internet

The Node-RED editor should only be reachable from the internal network or through a VPN. Siemens advises protecting network access to the devices with appropriate mechanisms. If Node-RED is no longer in use, Siemens also lists removing it as an option.

Enable adminAuth and HTTPS

In settings.js, enable adminAuth with the credentials type, then generate a password hash with node-red admin hash-pw (available since Node-RED 1.1.0). Give full access (*) only to administrators and read-only access (read) to everyone else. If your flows use http in nodes, protect them with httpNodeAuth, and turn on the https option so passwords are not sent unencrypted. IoT2050 Advanced owners should also update to V4.3.4.1.

Review suspicious flows

Open every flow and look for exec or http in nodes your team never created, especially ones wired directly to each other. VulnCheck recommends this review because some attackers leave webshells in place of bots. If you find a foreign flow, disconnect the device, preserve evidence, reinstall from a clean backup, and rotate every credential stored on it.

Factories that are connecting machines to monitoring systems can use this incident as a reason to review their network design. Merakit helps through its IoT services and industrial automation solutions, including separating machine networks from the internet and controlling gateway access.

Frequently asked questions

Are all Node-RED installations affected?

The official advisory for CVE-2026-58115 names only the SIMATIC IoT2050 Advanced. However, VulnCheck reports that attackers are targeting any Node-RED instance whose editor is open without adminAuth. Installations with login enabled and access limited to the internal network are far harder to reach this way.

Is there a Node-RED release that fixes this?

The fix Siemens announced is a device update for the IoT2050 Advanced to V4.3.4.1. For other Node-RED installations, the sources we reviewed do not name a specific fixed release. Protection depends on configuration: adminAuth turned on, internet access blocked, and HTTPS in use.

How can I tell whether a server has been compromised?

Check the flow list for unfamiliar exec or http in nodes, and check the processes running on the server for programs you do not recognize. VulnCheck also published the attacker IP and payload servers in its report, which you can match against firewall logs. If you find signs of intrusion, treat the server as untrusted until it has been rebuilt.

Conclusion

CVE-2026-58115 shows how one missed setting can hand over full control of a server at the heart of a production system. The checks are simple and can be finished in a day: find your instances, block outside access, turn on login, and review the flows. If your team needs help reviewing the security of gateways and IoT devices, Merakit’s cybersecurity team is ready to talk.

Sources

• SSA-834709: Missing Authentication Vulnerability in Node-RED on SIMATIC IoT2050 Advanced with Industrial OS, Siemens ProductCERT, August 11, 2026
• Exploitation Targeting Node-RED, a Tool Embedded in ICS Products, VulnCheck, November 2, 2026
• Critical Node-RED Flaw Exploited in Attacks, SecurityWeek, November 3, 2026
• Securing Node-RED, official Node-RED documentation
• Configuration and About, official Node-RED documentation