Node-RED CVE-2026-58115: Unauthenticated RCE Exploited in the Wild (What to Test)

1. What the flaw is

Node-RED is the open-source flow-based editor that most teams first met as a cute way to wire together an MQTT topic, a Slack webhook, and a dashboard chart. The under-sold piece is that Node-RED's Function node executes arbitrary JavaScript on the server process — not in a sandbox, not in a worker, in-process. That makes the admin HTTP interface — the thing that accepts new flows — equivalent in trust level to "give me a shell on this host."

CVE-2026-58115 is a missing-authentication defect in the admin HTTP interface for a common deployment configuration. Instances that were started without explicit adminAuth (and there are many — the pattern was promoted in early tutorials, carried forward in container images, and baked into bundled distributions) accept unauthenticated POSTs to /flows. An attacker:

# 1. Fingerprint
curl -sS http://target:1880/settings | jq '.version'

# 2. Deploy a flow with a Function node that runs attacker code
curl -sS -X POST http://target:1880/flows \
  -H 'Content-Type: application/json' \
  -H 'Node-RED-Deployment-Type: full' \
  --data '[{"id":"n1","type":"function","func":"require(\'child_process\').exec(\'id > /tmp/x\')"}]'

# 3. Trigger — Function nodes fire on injection from any upstream;
#    attacker wires an Inject node to the Function node and includes it in the same deploy.

The moment the flow deploys, the Function body runs under the Node-RED process. That process runs as whatever user systemd / Docker set it to — in appliance firmware, that is often root, in sloppy container images, it's often the container's primary user with unrestricted egress.

2. Attacks in the wild

VulnCheck flagged the first opportunistic exploitation on 30 October 2026 — a single actor scanning for exposed Node-RED instances and dropping a cryptominer. By 1 November 2026, VulnCheck had logged at least 15 more distinct incidents across unrelated hosts, which is the classic shape of a "scanner-and-stage-zero" campaign going from one actor to a public exploit kit.

The payloads so far cluster into three buckets:

• Cryptominers — most common. Function nodes drop a small Node.js wrapper that fetches and runs an XMRig binary. CPU usage is the only signal on commodity hosts.
• Mirai-variant botnet clients — the host becomes a scanning node, probing Telnet/SSH/HTTP for weak credentials on adjacent networks. On an OT appliance that straddles IT and OT segments, this is a direct pivot path.
• Node.js reverse shells — interactive access for hands-on-keyboard follow-on. Typically a short net.connect back to attacker infrastructure that spawns a shell and pipes it. Expect persistence attempts (new Node-RED flows that re-establish on restart, cron entries, systemd timer units).

Mean time from internet-exposure to first probe is already under 24 hours. Mean time from first probe to a working payload is often minutes — the attack is a single HTTP POST.

3. Exposure in ICS and OT products

The individual developer running Node-RED on a VPS is one problem. The much bigger problem is that Node-RED ships bundled inside vendor products, often with default-on admin interfaces and documentation that pre-dates the current risk model. Public exposure as of 5 November 2026 (vendor advisories or community confirmation):

• Siemens SIMATIC — SIMATIC IoT connectors and some Energy Suite components embed Node-RED. ProductCERT advisory issued; firmware updates staged.
• Rockwell FactoryTalk — select connector packages ship a Node-RED instance for OT ↔ IT bridging. Rockwell PSIRT acknowledges; mitigation guidance published.
• Schneider Electric and Honeywell — bundled Node-RED in selected industrial-automation integration packs. Advisories in progress.
• Home Assistant Supervised / OS — Node-RED available as a first-party add-on; many community instances exposed via Nabu Casa or direct port-forwarding.
• AWS IoT Greengrass examples — reference deployments spin up Node-RED for flow orchestration; default auth often off in demo configurations that got deployed to production.
• IBM / legacy Watson IoT — deprecated but still running in a surprising number of estates.
• Custom OT gateways — any appliance that advertises "visual flow editor" on top of Node.js almost certainly ships Node-RED.

If your environment has an OT or industrial IoT footprint, treat "do we run Node-RED?" as the wrong question. The right one is: "which of our bundled vendor products contains Node-RED, and what is its exposed admin port?"

4. Detection and hardening

Harden every Node-RED instance

1. Upgrade to the fixed Node-RED release. Check the Node-RED security advisory for your major line and apply the patched version. Appliance firmware: follow vendor advisories above.
2. Enable adminAuth in settings.js. If you ever read "we'll add auth later", later is now:

   // settings.js
   adminAuth: {
     type: "credentials",
     users: [{
       username: "admin",
       password: "<bcrypt hash via: node-red admin hash-pw>",
       permissions: "*"
     }]
   }

3. Bind admin to loopback or a private interface. In settings.js: uiHost: "127.0.0.1" or your private subnet. Reverse-proxy through authenticated, logged ingress if you need remote access.
4. Lock down Function nodes. Use the functionGlobalContext and functionExternalModules: false settings to limit what Function nodes can import. On high-value hosts, disable Function nodes entirely and whitelist specific node packages.
5. Egress controls. The Node-RED process should not be able to reach arbitrary internet hosts. Lock egress to the specific IoT endpoints it legitimately calls.
6. Container defaults. Do not run Node-RED containers as root. Drop capabilities, set read-only filesystem, use a non-privileged user.

Hunt for prior exploitation

• Flow file diffs. Compare the current flows.json on each instance against your known-good baseline. New Function nodes with suspicious bodies (long base64 blobs, require('child_process'), net.connect) are the giveaway.
• Process tree. Child processes spawned by the Node-RED process — especially shells, wget, curl, bash -i, or named binaries — should not happen in normal operation.
• Outbound connections from the Node-RED host to unfamiliar IPs. Egress logs, NetFlow, or eBPF-based runtime detection all catch this cleanly.
• Admin-API access logs. Any unauthenticated POST /flows from an IP outside your known admin ranges in the last 30 days is incident-grade.
• New systemd units / cron entries on the host, especially persistence that re-launches a Node.js script.
• CPU anomalies. Sustained near-100% on a flow-orchestration host that normally idles is the cryptominer signature.

5. How TigerStrike tests for it

Our VAPT AI Engine ships a Node-RED detection and exploitation pack in the November 2026 release. It runs on every scheduled sweep against your ASM-discovered surface and performs:

1. Discovery. Banner-grab on ports 1880 and configured custom ports, HTTP response-shape fingerprinting on /red/, /settings, /flows, and the characteristic favicon hash. Appliance-bundled instances behind reverse proxies still match on response shape.
2. Auth-state probe. Checks whether admin endpoints respond unauthenticated — GET /settings, GET /flows, GET /nodes. Any 200 instead of 401 means the instance is in the vulnerable configuration.
3. Safe exploitation check. On a confirmed-vulnerable instance, the engine deploys a marker-only flow (no shell execution, no filesystem writes, no network calls). The flow returns a signed-unique echo string on the editor's own debug channel, which is proof of RCE capability without any side-effects. You can disable the exploitation step per scope if your governance requires non-interactive runs only.
4. Blast-radius mapping. The engine links the Node-RED finding to the attack path — which upstream firewall rules got the attacker to this port, which downstream networks this host can reach — so you see "Node-RED on PA-5020 management VLAN → OPC UA bridge → plant floor" in one chain.
5. Reproducible payload artefact. Each finding ships with the exact HTTP request your developer or appliance admin can replay to confirm the fix landed. No PDFs.

See continuous VAPT for the surrounding program — scheduled runs, attack-path-linked findings, signed audit evidence.

6. FAQ

Sources

• VulnCheck exploitation telemetry, 30 October – 1 November 2026
• Node-RED: Securing Node-RED — official hardening guide
• CVE-2026-58115 at NVD
• Vendor advisories: Siemens ProductCERT, Rockwell PSIRT (in progress), Schneider Electric, Honeywell — 5 November 2026