Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LiveCriticalPartly patchedPatch now

Node-RED missing adminAuth actively exploited to drop bots and webshells (CVE-2026-58115)

Node-RED (including Siemens SIMATIC IoT2050 Advanced)

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

CVE-2026-58115 is a missing-authentication flaw in Node-RED's HTTP admin interface (CVSS 10.0 in Siemens' advisory for SIMATIC IoT2050 Advanced). Unauthenticated attackers who can reach the editor can deploy malicious flows that run shell commands via built-in inject and exec nodes. Siemens disclosed it in August 2026 for Industrial OS with Node-RED before V4.3.4.1. On Oct 30–Nov 1 2026 VulnCheck canaries caught complete exploit POSTs to /flows that downloaded a Linux bot, shell scripts and persistent webshells from attacker-controlled hosts; VulnCheck added the bug to its KEV catalog. Any internet-exposed Node-RED instance without adminAuth is at risk. Enable adminAuth, block external access, update Siemens IoT2050 to V4.3.4.1 or later where applicable, and audit flows for unexpected exec or HTTP-in nodes.

Why this severity: CVSS 10.0 missing authentication; actively exploited Oct 30–Nov 1 2026 to deploy bots and webshells (VulnCheck)

Started
Oct 30, 2026
CVE
CVE-2026-58115

Follow this incident

Discuss on X ↗

Affected

  • Node-RED instances without adminAuth enabled and reachable over the network
  • Siemens SIMATIC IoT2050 Advanced before V4.3.4.1 (Industrial OS with Node-RED)

Fixed in

  • Enable adminAuth / restrict network access (all Node-RED)
  • Siemens SIMATIC IoT2050 Advanced V4.3.4.1 or later

Timeline3

  1. Help Net Security and SecurityWeek report active exploitation dropping Linux bots and webshells; VulnCheck adds CVE-2026-58115 to its KEV catalog.

  2. VulnCheck canary receives a full exploit POST /flows deploying a Node-RED flow that downloads bot-linux-amd64; more hits through Nov 1 from a Microsoft-cloud IP in Brazil.

  3. Siemens discloses the Node-RED missing-authentication issue for SIMATIC IoT2050 Advanced (CVSS 10.0) and ships V4.3.4.1.

Advisories2

News & write-ups2

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo