Attackers Exploit Critical Node-RED Flaw to Deploy Malware

VulnCheck says attackers have exploited CVE-2026-58115, a critical Node-RED vulnerability rated 10/10 on the CVSS scale. The flaw is a lack of authentication on Node-RED’s HTTP interface, which can expose programming nodes capable of running system commands. Node-RED is a browser-based, low-code tool for building event-driven applications and is used in products across several sectors, including industrial control and operational technology (ICS/OT).

Siemens disclosed the vulnerability on 11 August after identifying it in SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. Siemens says the flaw could let an unauthenticated remote attacker create malicious flows and execute code on the underlying server with maximum privileges. SIMATIC IoT2050 Advanced version 4.3.4.1 and later include a fix.

VulnCheck reported successful exploitation in the wild on 30 October. It said an attack from an IP address on Microsoft’s network delivered an exploit that deployed and automatically ran a Node-RED flow, then fetched a binary from an attacker-controlled server. The payload was a Linux bot, with its filename suggesting attackers had prepared versions for multiple architectures.

By 1 November, VulnCheck had recorded 15 further attacks from the same address, including delivery of persistent webshells that could enable arbitrary commands on compromised servers. The company says attackers are scanning for Node-RED instances without adminAuth and exploiting them with a single HTTP request. It recommends checking external exposure and deployed flows for unexpected exec nodes or HTTP endpoints.