Node-RED bug with a perfect 10 severity is already under attack

VulnCheck says it caught real-world exploitation of CVE-2026-58115, a Node-RED vulnerability that scores a flawless 10 out of 10 on the CVSS scale. The first hit landed October 30, fired off from an IP inside AS8075, Microsoft's network range, and it arrived as a fully formed exploit. The flaw is a missing authentication check on Node-RED's HTTP interface, which opens the door to programming nodes that run system commands.

The October attack was efficient and sneaky. According to VulnCheck, it planted a Node-RED flow, set it running on its own, and yanked a binary down from an attacker-controlled server — all wrapped in three layers of encoding. The payload was a Linux bot, and the file name suggests the attackers had builds ready for several processor architectures. The command that launched it didn't even bother checking whether the install worked.

The campaign didn't stop there. By November 1, VulnCheck had spotted 15 more attacks from that same IP address, this time dropping extra payloads including persistent webshells that hand attackers a permanent way to run commands on compromised machines. The pattern, the company says, is automated: threat actors scan for Node-RED instances missing adminAuth protection and pop them with a single HTTP request.

The bug's reach goes well beyond hobby projects. Siemens disclosed it on August 11 after finding it in SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed, and warned that an unauthenticated remote attacker could craft malicious flows and execute arbitrary code with maximum privileges. Patches shipped in SIMATIC IoT2050 Advanced version 4.3.4.1 and later.

VulnCheck's advice is blunt: if Node-RED is running anywhere in your setup, including embedded in ICS/OT environments, check today whether it's reachable from outside your network. The company also says to review deployed flows for unexpected exec nodes or HTTP endpoints, since some attackers are leaving webshells behind instead of bots.