Node-RED authentication hole being exploited in the wild

Months after Siemens released fixes for an authentication hole in flow-based programming tool Node-RED, it remains unpatched by many users and attackers are taking advantage of it in the wild.  The problem involves open source IoT/IIoT systems, including those embedded in critical infrastructure, deployed outside the control of CISOs and CIOs. Security firm VulnCheck discovered the exploits and disclosed details in a blog post on Monday.  “On October 30, 2026, one of our canaries caught an attacker exploiting CVE-2026-58115, an unauthenticated Node-RED admin API flaw, to deploy a flow that downloads and runs a Linux bot. The request came from an IP in Microsoft’s ASN (AS8075),” the post said. “We have since seen 16 events from the same IP against this CVE, covering several different payloads.” The core problem is that Node-RED ships with the authentication option disabled; users are supposed to change the setting before it goes live.  Patrick Garrity, the VulnCheck security researcher who wrote the post, said the fact that Node-RED deployments are popular among those outside IT makes them susceptible to unsophisticated errors like this.  “They are put in place by relatively nontechnical people,” Garrity said in an interview. Aman Mahapatra, chief strategy officer for New York City-based technology consulting firm Tribeca Softech, said the Node-RED hole is not new, but it is still being leveraged in the wild. “The condition being exploited is one Node-RED has carried for years as a default: unless an administrator configures authentication, anyone who can reach the editor can deploy flows, and the project’s own documentation says as much,” he said. “Node-RED is popular precisely because engineers can wire it up without involving IT, which also means it rarely appears in an asset inventory. It is the same pattern behind this week’s supermarket refrigeration attacks: equipment installed outside the security team’s view, reachable from the internet, with authentication switched off.” Mahapatra pointed out that the biggest danger is the nature of the way users tend to deploy Node-RED.  “It is integration middleware. A typical deployment speaks Modbus, OPC UA, MQTT or S7 to controllers on one side and to databases, brokers and cloud services on the other, and it stores credentials for all of them,” he said. “A compromised instance is a credential vault for every system it touches and a bridge across an IT/OT boundary that the network diagram says does not exist.” Another problem is that industrial system patches tend to happen on pre-planned schedules, rather than responding to emergent issues or suggested setting changes. “Siemens published its advisory on August 11, and VulnCheck caught exploitation on October 30, three days after shipping its own detections,” Mahapatra said. “Eleven weeks is a short runway in OT, where firmware updates wait for planned maintenance windows, so a meaningful share of affected gateways will remain unpatched well into next year.” Frank Dickson, principal analyst at Dickson Research, added that the details of the exploits are a good news/bad news situation for CISOs. The good news is that the attacks did not appear to have targeted industrial systems. The bad news is the attackers found and accessed those systems anyway. Noah Kenney, principal consultant at Digital 520, agreed.  “They don’t necessarily need to understand the equipment or operations connected to these gateways. They’re simply looking for systems capable of executing their commands,” he said. “That creates a concerning possibility where industrial operations could be disrupted by attackers who never intended to target critical infrastructure in the first place. Even generic malware consuming system resources or interfering with network communications could have operational consequences.” Dickson added that closing this hole may not resolve the exposure. “The report also found that some attackers skipped the bot and left web shells, hidden back doors for running commands later,” Dickson said. “Patching closes the door. It does not evict anyone already inside.”