Node-RED missing adminAuth actively exploited to drop bots and webshells (CVE-2026-58115) · updates https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115 CVE-2026-58115 is a missing-authentication flaw in Node-RED's HTTP admin interface (CVSS 10.0 in Siemens' advisory for SIMATIC IoT2050 Advanced). Unauthenticated attackers who can reach the editor can deploy malicious flows that run shell commands via built-in inject and exec nodes. Siemens disclosed it in August 2026 for Industrial OS with Node-RED before V4.3.4.1. On Oct 30–Nov 1 2026 VulnCheck canaries caught complete exploit POSTs to /flows that downloaded a Linux bot, shell scripts and persistent webshells from attacker-controlled hosts; VulnCheck added the bug to its KEV catalog. Any internet-exposed Node-RED instance without adminAuth is at risk. Enable adminAuth, block external access, update Siemens IoT2050 to V4.3.4.1 or later where applicable, and audit flows for unexpected exec or HTTP-in nodes. en Tue, 03 Nov 2026 00:00:00 GMT Node-RED missing adminAuth actively exploited to drop bots and webshells (CVE-2026-58115): Help Net Security and SecurityWeek report active exploitation dropping Linux bots and webshells; VulnCheck adds CVE-2026-58115 to its KEV catalog. https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115 https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115#2026-11-03-e9808e0c Tue, 03 Nov 2026 00:00:00 GMT critical <p><a href="https://www.helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation/">Source</a></p> Node-RED missing adminAuth actively exploited to drop bots and webshells (CVE-2026-58115): VulnCheck canary receives a full exploit POST /flows deploying a Node-RED flow that downloads bot-linux-amd64; more hits through Nov 1 from a Microsoft-cloud IP in Brazil. https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115 https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115#2026-10-30-4180052a Fri, 30 Oct 2026 00:00:00 GMT critical <p><a href="https://www.vulncheck.com/blog/exploitation-targeting-node-red">Source</a></p> Node-RED missing adminAuth actively exploited to drop bots and webshells (CVE-2026-58115): Siemens discloses the Node-RED missing-authentication issue for SIMATIC IoT2050 Advanced (CVSS 10.0) and ships V4.3.4.1. https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115 https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115#2026-08-01-2705f405 Sat, 01 Aug 2026 00:00:00 GMT critical <p><a href="https://cert-portal.siemens.com/productcert/html/ssa-834709.html">Source</a></p>