Node-RED: unauthenticated RCE via missing auth on HTTP interface exploited in the wild (CVE-2026-58115)
Severity: critical · Patch status: patched · Since 2026-11-03 · CVE-2026-58115
VulnCheck observed successful in-the-wild exploitation of CVE-2026-58115, a CVSS 10 missing-authentication flaw in Node-RED's HTTP interface, starting October 30, 2026. Attackers from a single IP (in Microsoft's AS8075) deployed a Node-RED flow via a single unauthenticated HTTP request, pulled a Linux bot binary behind three encoding layers, and by November 1 delivered 15 more payloads including persistent webshells enabling arbitrary command execution. Node-RED is a low-code flow-based programming tool used across sectors, including embedded in commercial ICS/OT devices such as Siemens SIMATIC IoT2050 Advanced. Siemens disclosed the flaw on August 11; SIMATIC IoT2050 Advanced 4.3.4.1 and later contain patches. Threat actors are actively scanning for Node-RED instances without adminAuth and exploiting them automatically.
What to do
- Check immediately whether any Node-RED instance, including embedded in ICS/OT, is reachable from outside your network and restrict access
- Upgrade SIMATIC IoT2050 Advanced to 4.3.4.1 or later; update Node-RED generally
- Enable adminAuth on all Node-RED instances
- Review deployed flows for unexpected exec nodes or HTTP endpoints (webshells)
- Hunt for signs of compromise: unknown flows, bot binaries, persistence
Fixed versions
- SIMATIC IoT2050 Advanced 4.3.4.1
Sources
All live incidents on Threat Watch
