Critical Node-RED Flaw Exploited in Attacks

Security firm VulnCheck reports active exploitation of a maximum-severity flaw in Node-RED, the flow-based programming tool used in many industrial and IoT products. The bug, CVE-2026-58115 (CVSS 10/10), stems from missing authentication on Node-RED's HTTP interface, letting unauthenticated attackers reach programming nodes and run arbitrary system commands with full privileges. Siemens disclosed the issue on August 11 after discovering it in its SIMATIC IoT2050 Advanced devices running Node-RED, and fixed it starting with version 4.3.4.1. VulnCheck says it detected real exploitation beginning October 30, with a single IP address on Microsoft's network launching an automated attack that deployed a malicious flow, fetched a Linux bot, and later followed up with over a dozen more intrusions, some installing persistent webshells for ongoing remote access. The researchers warn that attackers are mass-scanning for exposed, unauthenticated Node-RED deployments—including those embedded in ICS/OT systems—and urge operators to restrict external access and inspect flows for suspicious exec nodes or HTTP endpoints.