A maximum-severity vulnerability in Node-RED, the popular flow-based programming tool embedded in thousands of industrial and IoT devices, is now being actively exploited by attackers to deploy Linux botnets, backdoors, and persistent webshells. Security researchers at VulnCheck confirmed in-the-wild exploitation of CVE-2026-58115 beginning October 30, raising urgent alarms for organizations running Node-RED in operational technology (OT) environments — particularly those using Siemens SIMATIC IoT2050 gateways.
What Happened
CVE-2026-58115 is an authentication bypass flaw in Node-RED’s administrative HTTP API. When the adminAuth setting is not configured — which is the default on many deployments — the entire management interface is wide open. An unauthenticated remote attacker can deploy arbitrary flows and execute system commands with the highest privileges available on the host. Siemens, which assigned the CVE, gave it the maximum CVSS score of 10.0.
The vulnerability was first disclosed in August 2026 as part of Siemens advisory SSA-834709, covering the SIMATIC IoT2050 Advanced running Industrial OS with Node-RED installed before version V4.3.4.1. But the real danger extends far beyond Siemens products: any Node-RED instance exposed to the internet without administrative authentication is vulnerable.
VulnCheck published detection artifacts on October 27 and added CVE-2026-58115 to its own Known Exploited Vulnerabilities catalog. As of this writing, CISA has not yet added the flaw to its KEV list — a gap that may leave some organizations unaware of the urgency.
How the Attack Works
The exploitation chain is alarmingly simple. The attacker sends a single HTTP POST request to the /flows endpoint — the same API that legitimate users rely on to deploy automation logic. The malicious payload is a complete Node-RED flow containing an inject node wired to an exec node. The inject node fires automatically one second after the flow deploys, with no further interaction needed.
To evade detection, the attackers wrap their shell commands in three layers of base64 encoding, obscuring the true payload from network-level inspection tools. Once decoded, the command uses wget (with a curl fallback) to download a Linux binary named bot-linux-amd64 from an attacker-controlled server. The binary is saved to /dev/shm/.b — a RAM-backed, hidden file path designed to avoid disk forensics — then executed in a detached process using setsid or nohup.
VulnCheck’s canary system, which detected the initial exploitation, recorded 16 separate exploit attempts from a single source IP between October 30 and November 1. That same IP also targeted eight other CVEs across Apache Solr, Camunda, Gitea, MLflow, Traefik, and Joomla — a pattern consistent with opportunistic mass scanning from shared or rented cloud infrastructure.
By November 1, the attackers escalated their campaign. Additional payloads included a staged shell script (wget.sh), a secondary implant disguised as a kernel worker thread (saved as /tmp/.kworker, mimicking legitimate Linux process names), and — most concerning — persistent webshells. These webshells create new HTTP endpoints (such as /cmd or randomly named paths) within Node-RED itself, wired to exec nodes that accept commands via URL query parameters. Unlike the in-memory bot, webshells survive reboots and give attackers a durable foothold.
Who Is Affected
The blast radius is significant. Node-RED is widely used across manufacturing, utilities, healthcare, agriculture, and building automation. It runs on everything from Raspberry Pi hobbyist setups to hardened industrial gateways. Scan data cited by Security Online shows over 20,000 Node-RED management interfaces currently exposed to the public internet — each one a potential target if adminAuth is not enabled.
The confirmed affected product is the Siemens SIMATIC IoT2050 Advanced (model 6ES7647-0BA00-1YA2) running Industrial OS before V4.3.4.1. These gateways are purpose-built for industrial edge computing and are commonly deployed in factory floors, energy facilities, and process control environments. A compromise here doesn’t just mean data theft — it could mean disrupted production lines, tampered sensor readings, or unauthorized commands sent to physical equipment.
VulnCheck also noted that Emerson’s documentation references Node-RED, though it has not verified whether Emerson products are directly exploitable via this flaw. Given how many vendors embed Node-RED as a configuration and automation interface, the true attack surface likely extends well beyond what has been publicly confirmed.
What to Do Now
Patch immediately. Siemens users should update to Industrial OS V4.3.4.1 or later, which enforces authentication on the web interface. For standalone Node-RED deployments, enable adminAuth in settings.js — this is the single most important step, as the vulnerability fundamentally depends on the absence of authentication.
Cut off external access. Node-RED’s default port 1880, and its administrative API, should never be directly reachable from the public internet. Place management consoles behind firewalls, VPNs, or authenticated reverse proxies with multi-factor authentication. This alone would have blocked the observed attacks.
Hunt for compromise. Audit your deployed flows for any unauthorized exec nodes or unexpected HTTP endpoints — these are the signatures of the webshells being planted. On the host, check for dropper artifacts at /dev/shm/.b, /tmp/.s, and /tmp/.kworker. Review network logs for connections to the known payload server IPs published in VulnCheck’s blog (85.215.73.250 on port 8080 and 45.194.90.57 on port 38472).
Monitor for catalog updates. VulnCheck has added CVE-2026-58115 to its KEV catalog, and CISA inclusion is likely forthcoming given the confirmed active exploitation. Organizations subject to CISA’s Binding Operational Directive 22-01 should not wait for the listing to act.
The Bigger Picture
CVE-2026-58115 is a textbook example of what happens when developer-friendly tools designed for trusted networks end up exposed on the internet. Node-RED was never built to be internet-facing without authentication, yet thousands of instances are. The attacker doesn’t need a sophisticated exploit chain — just a single HTTP POST to an unprotected API endpoint.
For OT and ICS security teams, this should be a wake-up call. The convergence of IT and OT means that tools like Node-RED, originally popular in hobbyist and prototyping circles, are now embedded deep in critical infrastructure. When a maximum-severity flaw in one of those tools goes from disclosure to active exploitation in weeks, the window for patching is razor-thin. The time to check your exposure is now — before the next POST request arrives.
Leave a Reply