Critical Authentication Bypass in Node‑RED (CVE‑2026‑58115) Enables Remote Code Execution and Bot Deployment
What It Is — Node‑RED, a flow‑based programming tool widely embedded in industrial control and IoT devices, contains an unauthenticated remote code execution flaw (CVE‑2026‑58115). The vulnerability resides in the way Node‑RED processes imported flow definitions: an attacker can POST a malicious flow that wires an inject node to an exec node, causing arbitrary shell commands to run with maximum privileges on the host. Siemens disclosed the issue in August 2026, assigning a CVSS 10.0 score and noting that all versions prior to 4.3.4.1 are vulnerable.
VulnCheck’s canary network observed active exploitation on 30 Oct 2026. The attacker delivered a complete exploit in a single HTTP POST, which downloaded a hidden Linux binary (named bot‑linux‑amd64) and executed it in the background. The binary’s purpose (cryptomining, DDoS, reverse shell, etc.) was not recovered. The same source IP, originating from a Microsoft‑owned range in Brazil, scanned for the flaw repeatedly and also probed seven other unrelated CVEs across different services, indicating opportunistic mass‑scanning.
Affected Products — Node‑RED (all versions < 4.3.4.1), including deployments embedded in Siemens SIMATIC IoT2050 Advanced and other industrial/OT solutions.
Why It Matters for Trust & Control Assurance — The incident tests the control objective of application‑level access control and secure configuration; organizations must demonstrate that only authorized users can modify runtime flows.
Recommended Actions —
- Upgrade Node‑RED to 4.3.4.1 or later on all devices.
- Enforce network segmentation and restrict inbound access to the Node‑RED HTTP endpoint.
- Enable strict authentication (e.g., OAuth2, TLS client certs) and disable anonymous flow imports.
- Deploy continuous monitoring for unexpected flow changes and audit log collection.
- Conduct a post‑patch validation scan to confirm remediation.
Source: Help Net Security – Attackers exploit critical Node‑RED flaw (CVE‑2026‑58115)