Attackers exploit Node-RED flaw to run commands on exposed systems

Security researchers have warned that a critical Node-RED remote code execution flaw, tracked as CVE-2026-58115 with a maximum CVSS v3 score of 10.0, is being exploited in the wild. VulnCheck reported that unauthenticated attackers can execute arbitrary system commands on exposed hosts by deploying malicious flows to Node-RED installations that lack administrative authentication.

The advisory notes live exploitation began around 30 October 2026, with telemetry showing automated attack flows targeting exposed systems, including a Microsoft address space IP delivering payloads to honeypots. The flaw is described as arising from missing authentication on the Node-RED administrative HTTP API, allowing any remote client to modify flows and trigger command execution.

In practice, researchers describe a three-layer dropper that begins with a single HTTP POST to the flows endpoint, linking an inject node to an exec node, which runs a base64-encoded shell wrapper to download a Linux bot binary from a remote staging server. The binary is written to /dev/shm and executed in a detached session to survive process exits.

Follow-on campaigns reportedly tested additional delivery methods and, in some cases, deployed persistent webshells via a dedicated HTTP input endpoint for on-demand command execution. Siemens has confirmed the vulnerability affects SIMATIC IoT2050 Advanced gateways running Industrial OS prior to version V4.3.4.1, and the patch is to upgrade to V4.3.4.1 which enforces authentication on the web interface.

For standalone Node-RED, administrators are urged to enable adminAuth in settings.js and to ensure management ports (including 1880) are not exposed to the public internet.