Node-RED authentication hole being exploited in the wild
Attackers are exploiting CVE-2026-58115 to deploy flows that download and run a Linux bot on unpatched Node-RED instances.
Months after Siemens released fixes for an authentication hole in flow-based programming tool Node-RED, it remains unpatched by many users and attackers are taking advantage of it in the wild. The problem involves open source IoT/IIoT systems, including those embedded in critical infrastructure. Security firm VulnCheck discovered the exploits and disclosed details in a blog post on Monday. The core problem is that Node-RED ships with the authentication option disabled; users are supposed to change the setting before it goes live. A compromised instance is a credential vault for every system it touches and a bridge across an IT/OT boundary.
- VulnCheck caught exploitation on October 30, 2026, three days after shipping its own detections.
- Eleven weeks is a short runway in OT, where firmware updates wait for planned maintenance windows.
- Some attackers skipped the bot and left web shells, hidden back doors for running commands later.
Impact: unauthenticated access to deploy flows and run Linux bot
- 1.Enable authentication in Node-RED
- 2.Patch to latest version
- 3.Monitor for unauthorized deployments
- CVEs
- CVE-2026-58115
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58115 | A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed) | 10.0 | <1% |
From the original article
3 min read at csoonline.com
Months after Siemens released fixes for an authentication hole in flow-based programming tool Node-RED, it remains unpatched by many users and attackers are taking advantage of it in the wild. The problem involves open source IoT/IIoT systems, including those embedded in critical infrastructure, deployed outside the control of CISOs and CIOs.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.