Attackers Exploit Node-RED Authentication Flaw to Deploy Malware

Attackers are actively exploiting a critical unauthenticated admin API vulnerability in the Node-RED programming tool to deploy Linux bots and web shells across IoT and industrial networks.

Security firm VulnCheck identified the exploitation of CVE-2026-58115, noting that on 30 October 2026, a canary detected an attacker using an IP from Microsoft’s ASN (AS8075) to deploy a flow designed to run a Linux bot. Multiple similar events have since been identified.

Risks to Industrial Control Systems

The vulnerability stems from the fact that Node-RED ships with authentication disabled by default. While users are expected to enable security settings before deployment, the tool is frequently installed by engineers outside the direct oversight of central IT or security departments.

Aman Mahapatra, chief strategy officer at Tribeca Softech, noted that these deployments often go unrecorded in official asset inventories. Because Node-RED acts as integration middleware, it connects controllers via protocols such as Modbus, MQTT, or OPC UA to cloud services. A compromised instance can therefore serve as a credential vault for every connected system.

This creates a significant risk of attackers bridging the gap between IT and operational technology (OT) networks, even in environments where such connectivity is not intended.

Slow Patching Cycles in OT Environments

Although Siemens released fixes for the flaw in August, many industrial gateways remain unpatched. In operational technology environments, firmware updates are typically tied to pre-planned maintenance windows rather than emergent security threats.

Experts warn that this delayed patching window leaves a significant number of affected systems exposed well into next year.

Security researcher Frank Dickson of Dickson Research also warned that simply patching the vulnerability may not be sufficient to secure a system. Evidence suggests some attackers have bypassed bot deployment in favour of installing web shells, which provide hidden backdoors for future command execution.