Node-RED CVE-2026-58115 Exploited to Deploy Linux Bots and Webshells
Summary
VulnCheck says attackers exploited unauthenticated Node-RED flaw CVE-2026-58115, using malicious flows to deploy Linux bots and persistent webshells. Siemens patched the flaw in SIMATIC IoT2050 Advanced 4.3.4.1 and later.
Key points
- VulnCheck reported successful in-the-wild exploitation of CVE-2026-58115 on October 30.
- The flaw affects Node-RED's HTTP interface: missing authentication can let attackers create flows that execute system commands.
- VulnCheck observed attacks deploying a Linux bot and, in later attacks, persistent webshells.
- The attacks reportedly used a single HTTP request and targeted Node-RED instances without adminAuth.
- Siemens disclosed the flaw after finding it on SIMATIC IoT2050 Advanced devices; version 4.3.4.1 and later include patches.
- VulnCheck advised checking whether Node-RED is reachable from outside the network and reviewing flows for unexpected exec nodes or HTTP endpoints.
Article Details
- Vulnerability Types
- Missing authentication on the Node-RED HTTP interface
- Unauthenticated remote code execution
- Severity
- Critical (CVSS 10/10)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Check whether Node-RED can be reached from outside the network.
- Review deployed flows for unexpected exec nodes or HTTP endpoints.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe exploit and payload delivery were described as being behind three layers of encoding.T1059 · Command and Scripting InterpreterThe vulnerability allowed access to Node-RED programming nodes that execute system commands; delivered webshells also enabled arbitrary command execution.T1105 · Ingress Tool TransferThe deployed Node-RED flow pulled a binary from an attacker-controlled server.T1190 · Exploit Public-Facing ApplicationAttackers exploited the Node-RED vulnerability with a single HTTP request against instances without adminAuth.T1505.003 · Web ShellSome attacks delivered persistent webshells that enabled arbitrary commands on compromised servers.
CVE
Vendors
Products
Industrial OSSiemens disclosed it on August 11, after finding it in its SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed.Node-REDHackers have started exploiting a critical-severity vulnerability in Node-RED to deploy various payloads, vulnerability intelligence company VulnCheck reports.Simatic IoT2050 AdvancedSiemens disclosed it on August 11, after finding it in its SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed.