Attackers are exploiting a maximum-severity authentication flaw in Node-RED to run commands on exposed servers, according to security firm VulnCheck. The bug, tracked as CVE-2026-58115 and scored 10 out of 10, leaves Node-RED’s HTTP interface open to unauthenticated requests that can reach nodes capable of executing system commands.
VulnCheck saw the first in-the-wild attempt on October 30 from an address inside Microsoft’s network. The attacker deployed a heavily obfuscated Node-RED flow that ran on its own and pulled down a Linux bot from a server the attacker controlled. By November 1 the same address had made 15 more attempts, some of them delivering persistent webshells instead of bots, as relayed by SecurityWeek.
Attackers are scanning for Node-RED instances that do not have the adminAuth setting turned on, and a single HTTP request is enough to exploit them. Siemens disclosed the flaw on August 11, and its SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed are named as affected. Fixes ship in firmware 4.3.4.1 and later.
Owners should first find out whether Node-RED is reachable from outside the network, including copies embedded in industrial and operational technology environments that asset lists often miss. VulnCheck also advises reviewing deployed flows for unexpected exec nodes or HTTP endpoints, since some intruders leave a backdoor behind rather than a bot. The reporting does not say which upstream Node-RED versions are affected, so teams outside the Siemens product line should check the project’s own advisory.