Node-RED authentication hole being exploited in the wild

Publisher excerpt From CSO Online

Months after Siemens released fixes for an authentication hole in flow-based programming tool Node-RED, it remains unpatched by many users and attackers are taking advantage of it in the wild. The problem involves open source IoT/IIoT systems, including those embedded in critical infrastructure, deployed outside the control of CISOs and CIOs. Security firm VulnCheck discovered the exploits and disclosed details in a blog post on Monday. “On October 30, 2026, one of our canaries caught an attacker exploiting CVE-2026-58115, an unauthenticated Node-RED admin API flaw, to deploy a flow that downloads and runs a Linux bot. The request came from an IP in Microsoft’s ASN (AS8075),” the post said. “We have since seen 16 events from the same IP against this CVE, covering several different payloads.” The core problem is that Node-RED ships with the authentication option disabled; users are supposed to change the setting before it goes live. Patrick Garrity, the VulnCheck security researcher who wrote the post, said the fact that Node-RED deployments are popular among those outside IT makes them susceptible to unsophisticated errors like this. “They are put in place by relatively nontechnical people,” Garrity said in an interview. Aman Mahapatra, chief strategy officer for New York City-based technology consulting firm Tribeca Softech, said the Node-RED hole is not new, but it is still being leveraged in the wild. “The condition being exploited is one Node-RED has carried for years as a default: unless an administrator configures authentication, anyone who can reach the editor can deploy flows, and the project’s own documentation says as much,” he said. “Node-RED is popular precisely because engineers can wire it up without involving IT, which also means it rarely appears in an asset inventory. It is the same pattern behind this week’s supermarket refrigeration attacks: equipment installed outside the security team’s view, reachable from the internet, with authentication switched off.” Mahapatra pointed out that the biggest danger is the nature of the way users tend to deploy Node-RED. “It is integration middleware. A typical deployment speaks Modbus, OPC UA, MQTT or S7 to controllers on one side and to databases, brokers and cloud services on the other, and it stores credentials for all of them,” he said. “A compromised instance is a credential vault for every system it touches and a bridge across an IT/OT boundary that the network diagram says does not exist.” Another problem is that industrial system patches tend to happen on pre-planned schedules, rather than responding to emergent issues or suggested setting changes. “Siemens published its advisory on August 11, and VulnCheck caught exploitation on October 30, three days after shipping its own detections,” Mahapatra said. “Eleven weeks is a short runway in OT, where firmware updates wait for planned maintenance windows, so a meaningful share of affected gateways will remain unpatched…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.