Attackers have started exploiting CVE-2026-58115, a critical flaw in Node-RED, to plant a Linux bot and webshells on servers they can reach over the internet. Vulnerability intelligence firm VulnCheck caught the first attempt on one of its decoy systems on 30 October and published a warning on 1 November. Help Net Security and SecurityWeek reported on it on 3 November.
Node-RED is a low-code tool built on Node.js for wiring together event-driven applications in a browser-based editor. It runs on boards like the Raspberry Pi as well as in the cloud, and it turns up in manufacturing, healthcare, home automation and commercial industrial control products. Anyone who has set it up for a side project, a dashboard or an integration should check how it is exposed.
The flaw
Siemens disclosed the bug on 11 August. It affects the company's SIMATIC IoT2050 Advanced devices when Node-RED is installed on their Industrial OS, and Siemens rated it 10.0 on the CVSS scale. SecurityWeek describes it as missing authentication on the Node-RED HTTP interface, which gives an outsider access to programming nodes that can run system commands. In Siemens' words, an unauthenticated remote attacker could create malicious flows and run code on the server "with maximum privileges".
Siemens says SIMATIC IoT2050 Advanced version 4.3.4.1 and later contain the fix. Neither report names a fixed release for standalone Node-RED installs; the common thread in VulnCheck's findings is that the targeted instances had no adminAuth configured, so the editor and its API were open to anyone who found them.
What the attacks look like
According to VulnCheck researcher Patrick Garrity, the first request was a complete, encoded exploit sent in a single HTTP call. It deployed a flow that ran on its own as soon as it landed, downloaded a file named bot-linux-amd64 from another server, stored it under a hidden name in memory-backed storage and started it in the background. VulnCheck did not obtain the binary, so it cannot say whether it is a miner, a DDoS bot, a reverse shell or something else. SecurityWeek adds that the file name suggests the attackers built versions for several processor architectures.
The same IP address, in Microsoft's network and located in Brazil, hit the flaw 16 times between 30 October and 1 November. Later payloads included a shell script, a file named to look like a kernel worker thread and several webshells. The bot lives in memory and disappears on reboot unless it finds another way to persist, but the webshells survive a restart and let the attackers return and run commands whenever they like.
Opportunistic, not targeted
Garrity calls this opportunistic mass scanning. Across VulnCheck's wider decoy network the same address made 125 attempts against eight different CVEs, both recent and older ones, in software that includes Gitea, Traefik, Joomla, MLflow, Camunda and Apache Solr. He notes that an address in a big cloud provider's range is usually a rented or hijacked virtual machine and says little about who is behind it.
That is the practical lesson: nobody needs to know your Node-RED instance exists for it to be attacked. Automated scanners look for open editors and exploit them in one request. VulnCheck added the flaw to its own catalog of known exploited vulnerabilities; at the time of the reports, CISA had not listed it in its KEV catalog, so it may not yet appear in tools that rely only on that list.
What to do
- Check today whether any Node-RED instance you run, including ones embedded in industrial or IoT devices, can be reached from outside your network.
- Make sure adminAuth is configured on every instance, and update SIMATIC IoT2050 Advanced devices to version 4.3.4.1 or later.
- Review deployed flows for exec nodes or HTTP endpoints you did not create, since some attackers leave webshells that survive a reboot.
- Compare your logs against the indicators of compromise in VulnCheck's post, including the attack source and payload server addresses.