Attackers are exploiting a maximum-severity Node-RED flaw in live attacks
Node-RED instances that lack admin authentication can be taken over with a single request, and operators should check exposure now.
Attackers have begun actively exploiting CVE-2026-58115, a maximum-severity (CVSS 10/10) missing-authentication flaw in the Node-RED flow-based programming tool, according to VulnCheck. The bug lets an unauthenticated remote party reach programming nodes that can run system commands, and Siemens disclosed it on August 11 in its SIMATIC IoT2050 Advanced devices, fixed in version 4.3.4.1 and later. VulnCheck saw a first successful intrusion on October 30 from an IP address inside Microsoft's network, which deployed a hidden flow that downloaded and ran a Linux bot. By November 1 it had recorded 15 further attacks from the same address, some dropping persistent webshells. Operators should confirm that their Node-RED instances are not reachable from outside their network, check for missing adminAuth settings, and review flows for unexpected exec nodes or HTTP endpoints.
Why it matters
The flaw lets anyone who can reach a Node-RED instance create flows that run code with full privileges, so exposure is the real risk. Siemens has fixed it in SIMATIC IoT2050 Advanced version 4.3.4.1 and later, but many Node-RED deployments are not Siemens devices. Attackers scan for instances without adminAuth, which means unprotected installations face the most immediate danger.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.