# Node-RED missing adminAuth actively exploited to drop bots and webshells (CVE-2026-58115) · pwn.watch > CVE-2026-58115 is a missing-authentication flaw in Node-RED's HTTP admin interface (CVSS 10.0 in Siemens' advisory for SIMATIC IoT2050 Advanced). Unauthenticated attackers who can reach the editor can deploy malicious flows that run shell commands via built-in inject and exec nodes. Siemens disclosed it in August 2026 for Industrial OS with Node-RED before V4.3.4.1. On Oct 30–Nov 1 2026 VulnCheck canaries caught complete exploit POSTs to /flows that downloaded a Linux bot, shell scripts and persistent webshells from attacker-controlled hosts; VulnCheck added the bug to its KEV catalog. Any internet-exposed Node-RED instance without adminAuth is at risk. Enable adminAuth, block external access, update Siemens IoT2050 to V4.3.4.1 or later where applicable, and audit flows for unexpected exec or HTTP-in nodes. Page: https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115 · generated 2026-11-04T14:14:08.250Z ## Status - Severity: critical · status: live · patch: partial - Product: Node-RED (including Siemens SIMATIC IoT2050 Advanced) - Started: 2026-10-30 - CVEs: CVE-2026-58115 - Affected: Node-RED instances without adminAuth enabled and reachable over the network; Siemens SIMATIC IoT2050 Advanced before V4.3.4.1 (Industrial OS with Node-RED) - Fixed in: Enable adminAuth / restrict network access (all Node-RED); Siemens SIMATIC IoT2050 Advanced V4.3.4.1 or later ## Follow this incident - RSS (one item per update): https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115/feed.xml - JSON Feed: https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115.json - This file: https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115/llms.txt ## Updates (newest first) - 2026-11-03: Help Net Security and SecurityWeek report active exploitation dropping Linux bots and webshells; VulnCheck adds CVE-2026-58115 to its KEV catalog. (https://www.helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation/) - 2026-10-30: VulnCheck canary receives a full exploit POST /flows deploying a Node-RED flow that downloads bot-linux-amd64; more hits through Nov 1 from a Microsoft-cloud IP in Brazil. (https://www.vulncheck.com/blog/exploitation-targeting-node-red) - 2026-08-01: Siemens discloses the Node-RED missing-authentication issue for SIMATIC IoT2050 Advanced (CVSS 10.0) and ships V4.3.4.1. (https://cert-portal.siemens.com/productcert/html/ssa-834709.html) ## Fix brief # Security brief: Node-RED missing adminAuth actively exploited to drop bots and webshells (CVE-2026-58115) Source: https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115 · status: live · severity: critical · updated Nov 4, 2026, 13:57 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is CVE-2026-58115 is a missing-authentication flaw in Node-RED's HTTP admin interface (CVSS 10.0 in Siemens' advisory for SIMATIC IoT2050 Advanced). Unauthenticated attackers who can reach the editor can deploy malicious flows that run shell commands via built-in inject and exec nodes. Siemens disclosed it in August 2026 for Industrial OS with Node-RED before V4.3.4.1. On Oct 30–Nov 1 2026 VulnCheck canaries caught complete exploit POSTs to /flows that downloaded a Linux bot, shell scripts and persistent webshells from attacker-controlled hosts; VulnCheck added the bug to its KEV catalog. Any internet-exposed Node-RED instance without adminAuth is at risk. Enable adminAuth, block external access, update Siemens IoT2050 to V4.3.4.1 or later where applicable, and audit flows for unexpected exec or HTTP-in nodes. Severity detail: CVSS 10.0 missing authentication; actively exploited Oct 30–Nov 1 2026 to deploy bots and webshells (VulnCheck) - Product: Node-RED (including Siemens SIMATIC IoT2050 Advanced) - CVE / advisory ids: CVE-2026-58115 ## Affected versions - Node-RED instances without adminAuth enabled and reachable over the network - Siemens SIMATIC IoT2050 Advanced before V4.3.4.1 (Industrial OS with Node-RED) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Enable adminAuth / restrict network access (all Node-RED) - Siemens SIMATIC IoT2050 Advanced V4.3.4.1 or later After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Specific notes If you run Node-RED: confirm adminAuth is on, the editor is not on the public internet, and review flows for unexpected exec/inject nodes. On Siemens IoT2050 Advanced, upgrade to V4.3.4.1+. Check VulnCheck IoCs if the instance was exposed. ## Latest updates - Nov 3, 2026: Help Net Security and SecurityWeek report active exploitation dropping Linux bots and webshells; VulnCheck adds CVE-2026-58115 to its KEV catalog. - Oct 30, 2026: VulnCheck canary receives a full exploit POST /flows deploying a Node-RED flow that downloads bot-linux-amd64; more hits through Nov 1 from a Microsoft-cloud IP in Brazil. - Aug 1, 2026: Siemens discloses the Node-RED missing-authentication issue for SIMATIC IoT2050 Advanced (CVSS 10.0) and ships V4.3.4.1. ## Advisories - [SSA-834709 (Siemens)](https://cert-portal.siemens.com/productcert/html/ssa-834709.html) (Siemens) - [Siemens SIMATIC IoT2050 Advanced | CISA](https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-03) (CISA) ## Write-ups & news - [Exploitation Targeting Node-RED, a Tool Embedded in ICS Products](https://www.vulncheck.com/blog/exploitation-targeting-node-red) - [Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)](https://www.helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation/) --- Machine-readable: https://pwn.watch/i/node-red-missing-authentication-cve-2026-58115.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.