Critical Node-RED flaw CVE-2026-58115 exploited in the wild to run code on exposed instances

What happened

A critical vulnerability tracked as CVE-2026-58115 affects Node-RED, and it is being exploited in attacks (SecurityWeek). The flaw is a missing authentication issue on the Node-RED HTTP interface that lets attackers reach programming nodes capable of executing system commands (SecurityWeek). Siemens describes it as allowing an unauthenticated remote attacker to create malicious flows and “execute arbitrary code on the underlying server with maximum privileges” (Help Net Security). It is rated CVSS 10.0 (Help Net Security).

Siemens disclosed the flaw in August under advisory SSA-834709, affecting its SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed (SecurityWeek). Who originally discovered the flaw is not confirmed in the sources (Help Net Security).

VulnCheck observed successful in-the-wild exploitation on 30 October 2026 (SecurityWeek). A single POST /flows request delivered a complete exploit: a Node-RED flow built with inject and exec nodes, automatically triggered on deployment, that downloaded a binary from an attacker-controlled server using three layers of encoding (Help Net Security). The payload was a Linux bot named bot-linux-amd64, run in the background from a hidden name in a memory-backed location (Help Net Security). The first attack came from an IP address in AS8075, a Microsoft network, that geolocated to Brazil (SecurityWeek, Help Net Security).

By 1 November 2026, VulnCheck had seen 15 more attacks from the same IP, delivering additional payloads including persistent webshells for running arbitrary commands (SecurityWeek). The bot does not survive a reboot unless persistence is set up separately, but the webshells do persist (Help Net Security). VulnCheck describes the activity as opportunistic mass scanning and says the source IP likely belongs to a rented or compromised VM, so the actual operator is not identified (Help Net Security). VulnCheck researcher Patrick Garrity warned that “Node-RED instances without adminAuth are being found and exploited automatically” (Help Net Security).

VulnCheck added CVE-2026-58115 to its own known exploited vulnerabilities catalog; as of writing, CISA had not listed it in its KEV catalog (Help Net Security).

Am I affected?

You are at risk if you run Node-RED without adminAuth configured, because attackers are scanning for exactly those instances and exploiting them with a single HTTP request (Help Net Security). The sources do not list an upstream Node-RED version range for the flaw (SecurityWeek).

For Siemens hardware, SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed are vulnerable in versions before V4.3.4.1 (Help Net Security). This also reaches Node-RED instances embedded in ICS and OT environments, which VulnCheck highlights specifically (SecurityWeek).

Signs you should check for (Help Net Security):

• Flows you did not create, especially ones using inject and exec nodes.
• A background process from a file named like bot-linux-amd64, or a file disguised as a kernel worker thread.
• Webshells or unexpected HTTP endpoints that allow remote command execution.

What to do now

1. Check whether Node-RED can be reached from outside your network, including instances embedded in ICS or OT environments (SecurityWeek).
2. Configure adminAuth so the Node-RED interface requires authentication, since unauthenticated instances are the ones being exploited (Help Net Security).
3. Apply available updates. For Siemens SIMATIC IoT2050 Advanced, update Industrial OS to V4.3.4.1 or later, which contains patches (SecurityWeek). No upstream Node-RED fixed version is named in the sources (SecurityWeek).
4. Review deployed flows for unexpected exec nodes or HTTP endpoints (SecurityWeek).
5. Implement detections and check your systems against VulnCheck’s indicators of compromise, which include the attack source IP and both payload server IPs (Help Net Security).

Sources

• SecurityWeek, Critical Node-RED flaw exploited in attacks
• Help Net Security, Attackers exploit CVE-2026-58115 in Node-RED