Aug 1, 2026
0 new incidents, 1 with updates.
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Updated
- LiveCriticalPartly patched
Node-RED missing adminAuth actively exploited to drop bots and webshells (CVE-2026-58115)
CVE-2026-58115 is a missing-authentication flaw in Node-RED's HTTP admin interface (CVSS 10.0 in Siemens' advisory for SIMATIC IoT2050 Advanced). Unauthenticated attackers who can reach the editor can deploy malicious flows that run shell commands via built-in inject and exec nodes. Siemens disclosed it in August 2026 for Industrial OS with Node-RED before V4.3.4.1. On Oct 30–Nov 1 2026 VulnCheck canaries caught complete exploit POSTs to /flows that downloaded a Linux bot, shell scripts and persistent webshells from attacker-controlled hosts; VulnCheck added the bug to its KEV catalog. Any internet-exposed Node-RED instance without adminAuth is at risk. Enable adminAuth, block external access, update Siemens IoT2050 to V4.3.4.1 or later where applicable, and audit flows for unexpected exec or HTTP-in nodes.
Node-RED (including Siemens SIMATIC IoT2050 Advanced)Since Oct 30, 2026
