Threat watch / Vulnerability
Node-RED: unauthenticated admin API flaw (CVE-2026-58115) exploited to drop a Linux bot and webshells
CVE-2026-58115 is a missing-authentication flaw in Node-RED, the low-code automation tool, rated CVSS 10.0. Siemens disclosed it on August 11, 2026 for Node-RED on its SIMATIC IoT2050 industrial devices. On October 30, VulnCheck's honeypots caught an attacker using it to push a flow that downloads a Linux bot, followed by webshells. VulnCheck says the activity looks like opportunistic mass scanning and has not seen it against Siemens products. No victims have been named.
- Sector
- Many sectors
- Way in
- Software flaw
- Product or vendor
- Node-RED, Siemens SIMATIC IoT2050
- How it happened
- The flaw gives "unauthenticated access to programming nodes that are capable of executing system commands on the server", according to VulnCheck. The attacker sent a Node-RED flow that downloads a file named bot-linux-amd64 and runs it from /dev/shm, then a second payload and webshells served through an "http in" endpoint. CSO Online notes that Node-RED ships with authentication disabled by default.[1][4] Checked 11 Nov 2026
- What was stolen
- Not public yet Checked 11 Nov 2026
- Who was impacted
- No victims named. VulnCheck saw the attacks on its own canaries (16 events from one IP between October 30 and November 1) and gives no count of exposed or compromised servers. Siemens lists all SIMATIC IoT2050 Advanced, Basic, M.2 and SM devices running Industrial OS with Node-RED before V4.3.4-1 as affected.[1][2] Checked 11 Nov 2026
- Threat actor
- Not attributed
- CVE
- CVE-2026-58115
Timeline
- Siemens publishes advisory SSA-834709: missing authentication in Node-RED on SIMATIC IoT2050, CVSS 10.0. The fix is to update to V4.3.4-1 or later; for the Example Image versions, "no fix is available", and Siemens advises hardening or uninstalling Node-RED. [2]
- A VulnCheck canary catches the first exploitation attempt, from an IP address on Microsoft's network (AS8075). VulnCheck says the IP "says little about who is behind it". [1][5]
- VulnCheck reports the exploitation and adds the CVE to its own KEV catalog. It was not in CISA's KEV catalog at the time. [1][3]
- Siemens updates its advisory (V1.1), changing its title and the list of affected products; a further update (V1.2) follows on November 10. [2]