Unknown actor exploits max-severity Node-RED flaw CVE-2026-58115 to deploy Linux bot via malicious flows
VulnCheck reports that an unknown actor is exploiting CVE-2026-58115, a CVSS 10.0 flaw in Node-RED, to deploy a flow that downloads and runs a Linux bot. Node-RED is widely used for workflow automation in ICS/OT environments and is embedded in commercial products such as the Siemens SIMATIC IoT2050. A VulnCheck canary caught an attacker exploiting the flaw on October 30, 2026. The activity came from a single IP that also probed other products, which suggests opportunistic mass scanning rather than targeted attacks. The flaw is in VulnCheck's KEV catalog but, as of publication, not in CISA's KEV.
Entenda a falha
A vulnerabilidade
CVE-2026-58115 (CVSS 10.0) is a missing-authentication flaw in the Node-RED HTTP interface on affected Siemens devices such as the SIMATIC IoT2050, where Node-RED is embedded. An unauthenticated remote attacker with network reach to the interface can create flows using nodes that execute system commands, which gives command execution on the device. The articles do not list affected or fixed versions; they only say to apply updates where available.
Como funciona
Node-RED lets users build flows by wiring nodes together and deploying them through its HTTP interface. On affected Siemens devices that interface accepts requests without authentication. An attacker submits a flow with an inject node, which fires at startup or on a schedule, wired to an exec node, which runs shell commands. Once the flow is deployed, the command runs immediately with no further interaction. In the observed attack, the exploit, flow and dropper arrived in a single POST /flows.
Por que é vulnerável
The root cause is missing authentication: the Node-RED HTTP interface on affected Siemens devices does not enforce it, so anyone who can reach it can access programming nodes capable of running system commands. The articles do not explain why this went unnoticed or what the fix changes.
Como foi descoberta
Siemens assigned the identifier CVE-2026-58115 in August, with the 10.0 CVSS rating. Exploitation was detected on October 30, 2026 by a VulnCheck canary, and VulnCheck researcher Patrick Garrity published an advisory on Monday (November 2). The activity came from one IP, 4.201.105[.]116 (Microsoft AS8075, geolocated to Brazil), which hit the flaw 16 times between October 30 and November 1 and logged 125 hits against eight CVEs, suggesting opportunistic mass scanning. A payload pointed to a separate download server, 85.215.73[.]250, and the bot-linux-amd64 binary was not retrieved. The flaw is in VulnCheck's KEV but, at publication, not in CISA's KEV.
Explicação gerada por IA a partir da matéria e dos artigos, em 02/11/2026 21:16.
Detalhes técnicos
- Affected Siemens devices do not enforce authentication on the Node-RED HTTP interface. Unauthenticated remote attackers can create malicious flows that execute system commands.
- The exploit wires an inject node (fires at startup or on a schedule) to an exec node (runs shell commands), so the command runs as soon as the flow is deployed. The full exploit, flow and dropper arrived in a single
POST /flows. - The source IP 4.201.105[.]116 (Microsoft AS8075, geolocated to Brazil) hit the Node-RED flaw 16 times between October 30 and November 1. It logged 125 hits against eight CVEs across VulnCheck's canary network, including the old Apache Solr flaw CVE-2019-17558 and targets such as Camunda, Gitea, MLflow, Traefik and Joomla.
- One hit delivered a payload pointing to a separate download server, 85.215.73[.]250. This suggests a scan-and-infect setup in which the exploiting hosts pull the implant from a dedicated server.
- The payload filename bot-linux-amd64 indicates a Linux AMD64 bot, and other builds may exist. Researchers did not retrieve the binary, so its behavior is unknown.
Remediação
- Check whether Node-RED instances, including those inside OT networks, are reachable from outside the network, and remove that exposure.
- Apply available updates and implement detections for malicious flow deployment (
POST /flows) and for the IOCs above.
Linha do tempo
-
Unknown actor exploits max-severity Node-RED flaw CVE-2026-58115 to deploy Linux bot via malicious flows
ler a análise desta fonte ocultar
VulnCheck reports that an unknown actor is exploiting CVE-2026-58115, a CVSS 10.0 flaw in Node-RED, to deploy a flow that downloads and runs a Linux bot. Node-RED is widely used for workflow automation in ICS/OT environments and is embedded in commercial products such as the Siemens SIMATIC IoT2050. A VulnCheck canary caught an attacker exploiting the flaw on October 30, 2026. The activity came from a single IP that also probed other products, which suggests opportunistic mass scanning rather than targeted attacks. The flaw is in VulnCheck's KEV catalog but, as of publication, not in CISA's KEV.
Technical Details
- Affected Siemens devices do not enforce authentication on the Node-RED HTTP interface. Unauthenticated remote attackers can create malicious flows that execute system commands.
- The exploit wires an inject node (fires at startup or on a schedule) to an exec node (runs shell commands), so the command runs as soon as the flow is deployed. The full exploit, flow and dropper arrived in a single
POST /flows. - The source IP 4.201.105[.]116 (Microsoft AS8075, geolocated to Brazil) hit the Node-RED flaw 16 times between October 30 and November 1. It logged 125 hits against eight CVEs across VulnCheck's canary network, including the old Apache Solr flaw CVE-2019-17558 and targets such as Camunda, Gitea, MLflow, Traefik and Joomla.
- One hit delivered a payload pointing to a separate download server, 85.215.73[.]250. This suggests a scan-and-infect setup in which the exploiting hosts pull the implant from a dedicated server.
- The payload filename bot-linux-amd64 indicates a Linux AMD64 bot, and other builds may exist. Researchers did not retrieve the binary, so its behavior is unknown.
Remediation
- Check whether Node-RED instances, including those inside OT networks, are reachable from outside the network, and remove that exposure.
- Apply available updates and implement detections for malicious flow deployment (
POST /flows) and for the IOCs above.