Attackers exploit an unauthenticated Node-RED flaw to run commands on exposed industrial and IoT gateways
November 1, 2026 (Exploitation seen October 30 to November 1, 2026)
Node-RED is a low-code tool widely used to connect sensors, machines and online services, including on industrial gateways. CVE-2026-58115 is a flaw that lets an unauthenticated person send a single request to a Node-RED administration interface and deploy a flow that runs commands. Siemens disclosed it in August for its SIMATIC IoT2050 Advanced devices that have Node-RED installed (advisory SSA-834709). VulnCheck released detection artifacts on October 27 and says a decoy system it runs recorded exploitation on October 30 from an address in Microsoft's network range. The same address made 16 attempts through November 1 and later delivered more payloads, including a Linux binary and web shells that give the attacker lasting access. VulnCheck links the attacks to instances without administrator authentication configured. VulnCheck added the flaw to its own exploited-vulnerability list, and its article says the flaw was not in CISA's catalog at that time. VulnCheck's page gives no fixed Node-RED version and no count of exposed instances, and no victim has been named.
Why it matters
Node-RED often sits on gateways between plant equipment and the network. If its administration page is reachable without a password, anyone can run commands on the device, which can become a foothold inside an industrial network.
What defenders can take from it
- Check whether any Node-RED instance can be reached from outside your network, and put it behind a VPN or secure gateway.
- Turn on administrator authentication (adminAuth) for every instance.
- Review deployed flows for unexpected exec nodes or HTTP endpoints. If you find them, treat the device as compromised.
- Siemens SIMATIC IoT2050 Advanced users: follow Siemens advisory SSA-834709.