Short answer: Hackers are using a critical flaw in Node-RED to deploy malicious software. Anyone with Node-RED in their systems should check for unauthenticated access and review flows for unexpected nodes.
TL;DR
- Hackers exploited a critical flaw in Node-RED.
- The vulnerability allowed unauthenticated access to execute code.
- VulnCheck observed successful attacks on October 30 and November 1.
- Siemens patched the issue in SIMATIC IoT2050 Advanced version 4.3.4.1.
What is CVE-2026-58115?
This issue is a critical security flaw in Node-RED, a programming tool that creates event-driven applications. Hackers can exploit this flaw to gain unauthorized access and run malicious code on the server. Node-RED is used in various sectors, including commercial ICS/OT devices. Siemens disclosed the vulnerability and provided patches for affected devices. Hackers have already used this flaw to deploy malicious software and leave persistent webshells, allowing them to run commands on compromised servers.
- Vulnerability
- A mistake or weakness in software that an attacker can misuse.
- Patch
- A software update from the maker that fixes a security weakness.
- Exploit
- Code or steps that take advantage of a weakness.
Key facts
| Reported by | SecurityWeek |
|---|---|
| Date reported | 03 Nov 2026 |
| CVE | CVE-2026-58115 |
| CVSS | 10.0 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| Weakness | CWE-306 (missing authentication) |
| CISA KEV | Not listed (no confirmed exploitation in KEV) |
| Affected product | Node-RED |
| Published in NVD | 2026-08-11 (CVE-2026-58115) |
How it works
Node-RED is a tool that lets you create applications using a browser. It has a part called the HTTP interface that should only be used by people who know the password. Hackers found out that they could access this part without the password, which lets them run dangerous commands on the server.
- Attacker reaches the Node-RED over the internet / network
- No login or account is needed
- Sends crafted input that triggers the missing authentication flaw
- Impact: data can be read, data or code can be changed, service crashes or stops
Skillmate analyst mapping (our judgement, not from the vendor):
- T1190 Exploit Public-Facing Application
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-08-11 | CVE-2026-58115 published in NVD | NVD |
| 2026-11-03 | Reported by SecurityWeek | SecurityWeek |
| 2026-11-06 | This Skillmate explainer published | Skillmate |
How to fix it
- Update Node-RED to the fixed release named in the vendor advisory.
- If you cannot patch today, limit who can reach the affected service and watch its logs.
How to detect it
Defenders should look for unusual system commands being executed, unexpected flows in Node-RED, and new webshells.
What is confirmed and what is not
| Confirmed | Not confirmed yet |
|---|---|
| CVE-2026-58115 is a real NVD record scored 10.0 CRITICAL | CISA KEV does not list CVE-2026-58115 as exploited in the wild |
| Reported by SecurityWeek | NVD links no vendor advisory for CVE-2026-58115 yet |
Why it matters
Companies and users should check if their Node-RED instances are secure and review their flows for unexpected commands.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What is Node-RED?
Node-RED is a programming tool that helps create event-driven applications using a browser-based editor.
What is the CVSS score for CVE-2026-58115?
The CVSS score for CVE-2026-58115 is 10/10, indicating it is a critical-severity vulnerability.
How can attackers exploit this vulnerability?
Attackers can use unauthenticated access to Node-RED to create malicious flows and execute arbitrary code on the server.
What should I do if I have Node-RED running on my device?
Check if Node-RED can be reached from outside your network and review deployed flows for unexpected exec nodes or HTTP endpoints.
Related Skillmate posts
Sources
- Critical Node-RED Flaw Exploited in Attacks (SecurityWeek)
- NVD CVE record (NVD)
How we wrote this: facts come from the sources above, NVD and CISA KEV. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.
