Attackers Are Exploiting Unauthenticated Node-RED Instances: Check Yours Now

Attackers are actively exploiting internet-facing instances of Node-RED, the free, open-source flow-based programming tool built on Node.js, that run without authentication, using a missing-authentication flaw tracked as CVE-2026-58115 to install a Linux bot and webshells on exposed servers, according to security firm VulnCheck. One of the company's canaries first caught an attack on October 30.

What is happening

When a Node-RED server is reachable without authentication, its admin API lets a remote attacker deploy malicious flows that run system commands on the server. Two built-in node types make it easy to weaponize, VulnCheck explains: an inject node fires as soon as the flow is deployed, and an exec node runs a shell command. In the observed attack, a single POST /flows request installed a flow that downloaded a file named bot-linux-amd64 into a memory-backed location and ran it in the background. Later requests planted webshells, which survive reboots. VulnCheck did not retrieve the bot binary, so it makes no claim about what the malware does once running.

The same source address hit the Node-RED flaw 16 times between October 30 and November 1, and logged 125 hits against 8 different CVEs in other products, including Apache Solr, Gitea, and Joomla. VulnCheck reads this as opportunistic mass scanning rather than a targeted campaign. The company added the flaw to its known-exploited-vulnerabilities catalog; CISA's KEV catalog did not list it at the time of writing.

Who is affected

The CVE was assigned by Siemens, which disclosed in August that its SIMATIC IoT2050 Advanced running Industrial OS with Node-RED installed, in versions before V4.3.4.1, is vulnerable and scored it CVSS 10.0. The exposure is broader than industrial gear, though: any Node-RED instance reachable from the internet without authentication configured is a target, including the Raspberry Pi and home-automation setups where the tool is popular. VulnCheck's warning is blunt: "Node-RED instances without adminAuth are being found and exploited automatically."

What to do

If you run Node-RED, check today whether it is reachable from outside your network, turn on authentication with adminAuth (the project's securing guide walks through it), and review the indicators of compromise in VulnCheck's post. On Siemens SIMATIC IoT2050 Advanced devices, update Industrial OS to V4.3.4.1 or later, or harden or uninstall Node-RED, as Siemens' advisory instructs. Node-RED is free, open-source software under the Apache 2.0 license.