Node-RED Remote Code Execution Flaw CVE-2026-58115 with 10.0 CVSS Exploited in the Wild
Do Son 
The Exploitation Activity | Image: VulnCheck
TL;DR
Security firm VulnCheck warned on November 2, 2026, that threat actors are actively exploiting a critical Node-RED RCE flaw in the wild. Tracked as CVE-2026-58115 with a maximum 10.0 CVSS score, the missing-authentication vulnerability lets unauthenticated remote attackers execute arbitrary system commands on exposed hosts. Attackers deploy malicious flows to drop Linux bot implants and install persistent webshells across operational technology networks. Administrators must restrict web administration access and enforce authentication immediately.
- CVE: CVE-2026-58115
- CVSS: 10.0 (Critical · CVSSv3)
- Product: Siemens SIMATIC IoT2050 Advanced
- Affected: < V4.3.4.1
- Status: Exploited in the wild
- Patched in: V4.3.4.1
- EPSS: 0.7% (30-day)
- Action: Update to V4.3.4.1 now
Why It Matters
Node-RED is a widely used flow-based development environment built on Node.js. Engineers rely on it to build event-driven automation for manufacturing, energy utilities, and smart infrastructure. According to internet scan data from security researchers, more than 20,000 Node-RED management interfaces remain exposed to the public internet.
Furthermore, major industrial vendors bundle the software into commercial hardware. For example, Siemens embeds the flow engine inside the SIMATIC IoT2050 Advanced gateway. Leaving these programming interfaces open to the internet exposes vital operational technology networks to direct external compromise.
According to an advisory published in the VulnCheck threat analysis report, active exploitation in the wild began on October 30, 2026. Telemetry captured live traffic from an IP address in Microsoft address space delivering automated attack flows to honeypots. The analysts noted: “What started as a single canary event gave us a complete exploit chain: an unauthenticated flow deployment, an automatic trigger, a three-layer encoded dropper, and a payload server we can now track.” While attackers actively weaponize this Node-RED RCE flaw in real-world campaigns, researchers have not published any standalone public proof-of-concept exploit tools.
How the Attack Works
The root problem stems from missing authentication on the administrative HTTP API. When an instance runs without administrative credentials, it accepts flow modifications from any remote client. The advisory explains: “CVE-2026-58115 allows unauthenticated access to programming nodes that are capable of executing system commands on the server.”
Three-Layer Dropper Execution
An attacker launches the intrusion by sending a single HTTP POST request to the flows endpoint. The payload contains a multi-layered structure designed to bypass basic network filters.
First, the flow links an inject node directly to an exec node. The inject node fires automatically one second after deployment. Next, the exec node processes a base64-encoded shell wrapper. This wrapper decodes a shell command and pipes it directly into the system shell.
Subsequently, the decoded shell script retrieves a compiled Linux bot binary from a remote staging server. The script attempts to download the file using wget, with an automated fallback to curl. It writes the binary to the memory-backed file path at /dev/shm/.b. This tmpfs location avoids writing data to physical disks and hides the file from standard directory listings.
Finally, the dropper runs the binary in a detached session using setsid and nohup. This execution method ensures the malicious process survives even if the parent Node-RED worker exits.
Secondary Payloads and Persistent Webshells
In follow-up campaigns, researchers observed the same threat actors testing additional delivery mechanisms. Some attempts pulled secondary shell scripts to automate local reconnaissance. Other attacks fetched implants disguised as kernel worker threads.
Moreover, several observed flows deployed persistent webshells instead of automated droppers. In these cases, the attacker created an HTTP input endpoint connected to an execution node. This configuration allows adversaries to execute arbitrary operating system commands on demand via simple URL parameters. Consequently, the backdoor remains accessible even after an appliance reboots.
Affected Versions
This Node-RED RCE vulnerability affects any Node-RED deployment running without administrative authentication enabled. Specifically, Siemens confirmed the vulnerability impacts SIMATIC IoT2050 Advanced gateways running Industrial OS prior to version V4.3.4.1.
Patch and Mitigation Steps
Siemens resolved the flaw by releasing Industrial OS version V4.3.4.1, which enforces authentication on the web interface. Administrators running SIMATIC devices should install this update immediately.
For standalone Node-RED instances, operators must enable the adminAuth configuration parameter in settings.js. As VulnCheck emphasized, “Node-RED instances without adminAuth are being found and exploited automatically, and that a deployment takes one HTTP request.”
In addition, security teams must ensure that administrative ports, including port 1880, never remain exposed to the public internet. Organizations should place all management consoles behind internal firewalls, virtual private networks, or reverse proxies with multi-factor authentication. Finally, defenders should review deployed flows to remove any unauthorized execution nodes or undocumented HTTP endpoints.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
