Node-RED CVE-2026-58115 Exploited: Lock Down Your Editor

Short answer: Attackers are exploiting CVE-2026-58115, a CVSS 10 missing authentication flaw in Node-RED, the low-code tool used for automation, home labs and industrial devices. If your Node-RED editor is reachable from the internet without a login (the adminAuth setting), an attacker can deploy a flow that runs commands on your server. Turn on adminAuth, take the editor off the public internet, and review your flows for anything you did not create.

The key facts

Item	Detail
CVE	CVE-2026-58115
Severity	CVSS 10 out of 10, according to SecurityWeek
Bug type	Missing authentication on the Node-RED HTTP interface
Needs a login	No
First exploitation seen	October 30, 2026, by VulnCheck
Payloads	A Linux bot, then persistent webshells
Vendor fix noted	Siemens SIMATIC IoT2050 Advanced 4.3.4.1 and later

Siemens first disclosed the flaw on August 11 after finding it in its SIMATIC IoT2050 Advanced devices, which ship with Node-RED. Siemens says it "could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges."

What the attacks look like

According to SecurityWeek, VulnCheck saw the first successful attack on October 30. The attacker "deployed a Node-RED flow, triggered it automatically, and pulled a binary from an attacker-controlled server, all behind three layers of encoding." By November 1, VulnCheck had seen 15 more attacks from the same IP address, some leaving webshells (hidden pages that let an attacker run commands later).

The attackers are scanning for Node-RED instances without adminAuth and exploiting them automatically with one HTTP request. Small and hobby installs are just as likely to be hit as large ones.

Step 1: check whether your editor is exposed

From a network outside your own (a phone on mobile data works), open http://your-address:1880/. If the flow editor loads without asking you to log in, you are exposed. Also check your router or firewall for a forwarded port 1880, and any reverse proxy that publishes Node-RED.

Step 2: turn on adminAuth

Generate a password hash:

node-red admin hash-pw

Then edit settings.js (usually ~/.node-red/settings.js) and add the hash:

adminAuth: {
    type: "credentials",
    users: [{
        username: "admin",
        password: "PASTE-THE-HASH-HERE",
        permissions: "*"
    }]
},

Restart Node-RED and confirm the editor now asks for a login. The official Securing Node-RED guide covers HTTPS and single sign-on options too. Use a strong, unique password.

Step 3: take it off the internet

A login helps, but the editor should not be public at all. Remove port forwarding for 1880, and reach Node-RED through a VPN or a reverse proxy that requires its own login. If you only use dashboards or HTTP endpoints publicly, publish only those paths.

Step 4: look for signs of compromise

VulnCheck's advice is to "review deployed flows for unexpected exec nodes or HTTP endpoints, since some attackers are leaving webshells rather than bots." Check:

• flows or tabs you did not create, especially ones using exec nodes
• http in nodes with paths you do not recognise
• unknown processes or binaries in /tmp and new cron jobs on the host
• outbound connections to addresses you do not know

If you find anything, assume the host is compromised. Rebuild it, restore flows from a known good copy, and change any credentials stored in Node-RED.

Step 5: update devices and Node-RED

If you use a Siemens SIMATIC IoT2050 Advanced, update to 4.3.4.1 or later. For other installs, keep Node-RED and its nodes current with npm install -g --unsafe-perm node-red or your platform's update method, and watch the Node-RED project for an official advisory.

Common mistakes

• Assuming nobody will find a Node-RED instance on an odd port. Automated scanners check every port.
• Turning on adminAuth but leaving an already-planted malicious flow running.
• Forgetting embedded Node-RED in industrial or IoT devices, which is often installed and forgotten.
• Protecting the editor but leaving an http in webshell endpoint open.
• Storing database or cloud credentials in flows and not rotating them after a suspected attack.