{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Node-RED missing adminAuth actively exploited to drop bots and webshells (CVE-2026-58115) · updates",
  "home_page_url": "https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115",
  "feed_url": "https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115/feed.json",
  "description": "CVE-2026-58115 is a missing-authentication flaw in Node-RED's HTTP admin interface (CVSS 10.0 in Siemens' advisory for SIMATIC IoT2050 Advanced). Unauthenticated attackers who can reach the editor can deploy malicious flows that run shell commands via built-in inject and exec nodes. Siemens disclosed it in August 2026 for Industrial OS with Node-RED before V4.3.4.1. On Oct 30–Nov 1 2026 VulnCheck canaries caught complete exploit POSTs to /flows that downloaded a Linux bot, shell scripts and persistent webshells from attacker-controlled hosts; VulnCheck added the bug to its KEV catalog. Any internet-exposed Node-RED instance without adminAuth is at risk. Enable adminAuth, block external access, update Siemens IoT2050 to V4.3.4.1 or later where applicable, and audit flows for unexpected exec or HTTP-in nodes.",
  "language": "en",
  "_pwn": {
    "slug": "node-red-missing-authentication-cve-2026-58115",
    "severity": "critical",
    "status": "live",
    "patchStatus": "partial",
    "rss": "https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115/feed.xml",
    "llms": "https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115/llms.txt",
    "json": "https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115#2026-11-03-e9808e0c",
      "url": "https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115#2026-11-03-e9808e0c",
      "title": "Node-RED missing adminAuth actively exploited to drop bots and webshells (CVE-2026-58115): Help Net Security and SecurityWeek report active exploitation dropping Linux bots and webshells; VulnCheck adds CVE-2026-58115 to its KEV catalog.",
      "content_text": "Node-RED missing adminAuth actively exploited to drop bots and webshells (CVE-2026-58115): Help Net Security and SecurityWeek report active exploitation dropping Linux bots and webshells; VulnCheck adds CVE-2026-58115 to its KEV catalog.\n\nSource: https://www.helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation/",
      "date_published": "2026-11-03T00:00:00.000Z",
      "external_url": "https://www.helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115#2026-10-30-4180052a",
      "url": "https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115#2026-10-30-4180052a",
      "title": "Node-RED missing adminAuth actively exploited to drop bots and webshells (CVE-2026-58115): VulnCheck canary receives a full exploit POST /flows deploying a Node-RED flow that downloads bot-linux-amd64; more hits through Nov 1 from a Microsoft-cloud IP in Brazil.",
      "content_text": "Node-RED missing adminAuth actively exploited to drop bots and webshells (CVE-2026-58115): VulnCheck canary receives a full exploit POST /flows deploying a Node-RED flow that downloads bot-linux-amd64; more hits through Nov 1 from a Microsoft-cloud IP in Brazil.\n\nSource: https://www.vulncheck.com/blog/exploitation-targeting-node-red",
      "date_published": "2026-10-30T00:00:00.000Z",
      "external_url": "https://www.vulncheck.com/blog/exploitation-targeting-node-red",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115#2026-08-01-2705f405",
      "url": "https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115#2026-08-01-2705f405",
      "title": "Node-RED missing adminAuth actively exploited to drop bots and webshells (CVE-2026-58115): Siemens discloses the Node-RED missing-authentication issue for SIMATIC IoT2050 Advanced (CVSS 10.0) and ships V4.3.4.1.",
      "content_text": "Node-RED missing adminAuth actively exploited to drop bots and webshells (CVE-2026-58115): Siemens discloses the Node-RED missing-authentication issue for SIMATIC IoT2050 Advanced (CVSS 10.0) and ships V4.3.4.1.\n\nSource: https://cert-portal.siemens.com/productcert/html/ssa-834709.html",
      "date_published": "2026-08-01T00:00:00.000Z",
      "external_url": "https://cert-portal.siemens.com/productcert/html/ssa-834709.html",
      "tags": [
        "critical"
      ]
    }
  ]
}