VulnCheck, a company specializing in vulnerability intelligence, has revealed the detection of active attacks exploiting a critical security vulnerability in the low-code programming tool Node-RED. The vulnerability, identified as CVE-2026-58115, received a maximum severity rating (10/10) due to its ease of exploitation and severe impact.
Nature of the Vulnerability and Its Impact
The problem lies in the absence of authentication on Node-RED's HTTP interface, granting unauthorized attackers the ability to access programming nodes and execute system commands with full privileges. This tool is widely used in event-driven applications, including Industrial Control Systems (ICS) and Operational Technology (OT) systems.
Siemens had disclosed this vulnerability on August 11 after discovering it in SIMATIC IoT2050 Advanced devices, and released security updates for versions 4.3.4.1 and later to close this gap.
Details of Observed Attacks
According to VulnCheck data, actual attacks began on October 30, where an attack was observed from an IP address belonging to the Microsoft network (AS8075). The attacks included a series of technical steps:
- Deploying a malicious flow within Node-RED.
- Automatically running the flow to fetch binary files from an attacker-controlled server.
- Using multi-layered encryption techniques to hide the software payload.
By November 1, 15 additional attacks were observed from the same source, where attackers executed various payloads including a Linux bot and webshells to ensure continued access to compromised servers and the execution of arbitrary commands.
What Does This Mean for Users?
These attacks confirm that attackers are actively scanning the internet for Node-RED instances that lack authentication settings (adminAuth). To protect systems, experts recommend the following:
- Verify whether Node-RED instances are accessible from outside the internal network and restrict this access immediately.
- Review deployed flows for any unfamiliar execution nodes (exec nodes) or suspicious HTTP endpoints.
- Ensure all devices relying on Node-RED, especially in industrial environments, are updated to the latest versions available from manufacturers.