Node-RED Flaw Exploited to Deploy Bots and Webshells

Attackers are exploiting CVE-2026-58115, a critical Node-RED vulnerability that enables unauthenticated remote command execution. VulnCheck observed the activity from Oct. 30 and found Linux bots and persistent webshells on exposed systems.

The flaw has a CVSS score of 10 out of 10 and affects Node-RED’s HTTP interface. It allows attackers to reach programming nodes that can execute system commands, create malicious flows and run arbitrary code on the underlying server with maximum privileges.

The first observed attack came from an IP address in AS8075, a network operated by Microsoft. The attackers installed a Node-RED flow, configured it to run automatically and downloaded a binary from a server they controlled. Three layers of encoding concealed the commands and payload.

The payload was a Linux bot. The execution command did not check whether the installation succeeded. Based on the downloaded file’s name, VulnCheck determined that the attackers may have prepared versions for multiple processor architectures. By Nov. 1, the same IP address had been linked to 15 more attacks that delivered additional payloads, including persistent webshells for running commands on compromised servers.

The attacks targeted Node-RED installations without the platform’s adminAuth protection. VulnCheck found that attackers could exploit those systems with a single HTTP request. The company advised organizations to check whether Node-RED is accessible from outside their networks and to inspect deployed flows for unexpected command-execution nodes or HTTP endpoints.

Node-RED is a low-code development tool that lets users build event-driven applications through a browser-based editor. It is used in products across several industries, including industrial control and operational technology systems.

Siemens disclosed the vulnerability on Aug. 11 after finding it in SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. The company described the flaw as a missing authentication control that could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges.

SIMATIC IoT2050 Advanced version 4.3.4.1 and later include a patch. Organizations using Node-RED in embedded industrial systems or other environments can check whether the affected interface is externally accessible and review existing flows for unauthorized changes.