Attackers Exploit Unauthenticated Node-RED Admin API to Drop Malware

Threat actors are actively leveraging a critical Node-RED vulnerability tracked as CVE-2026-58115 to compromise exposed industrial and operational technology (OT) gateways. The flaw allows unauthenticated remote attackers to interact directly with the Node-RED admin API, enabling them to inject custom flows, execute arbitrary code, and gain full control over host systems. Because Node-RED historically ships with administrative authentication disabled by default, thousands of internet-facing instances remain wide open to opportunistic attack.

Security monitoring caught initial in-the-wild exploitation on October 30, 2026, following the release of detection signatures days prior. Threat activity originated from an IP address hosted within Microsoft’s ASN (AS8075), with attackers executing automated HTTP requests against exposed Node-RED administration endpoints. In these attacks, adversaries deployed malicious flows specifically designed to download and execute Linux bot payloads, alongside secondary activity involving the installation of persistent web shells. At least 16 distinct attack attempts stemming from the same infrastructure have been observed executing varied payloads.

In-the-Wild Exploitation of CVE-2026-58115

The vulnerability stems from missing authentication for critical functionality (CWE-306) within the Node-RED admin API interface. Node-RED carries a CVSS v3.1 score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting low attack complexity, zero privilege requirements, and network reachability without requiring user interaction.

Crucially, the CVSS vector highlights a changed scope (S:C). In practice, a compromised Node-RED instance does not just grant local code execution on the host gateway—it exposes every downstream controller, cloud service, and internal database wired into the flow editor. While the measured Exploit Prediction Scoring System (EPSS) rating sits at 0.89% (59.4th percentile), live honeypot telemetry confirms that automated exploitation scripts are actively scanning for and compromising reachable endpoints.

Attackers are utilizing Node-RED’s built-in functionality against itself. By posting flow configurations directly to the unauthenticated admin endpoint, attackers deploy standard function or exec nodes. These nodes trigger underlying operating system shells to fetch external ELF binaries, execute Linux bots, or write backdoors into public-facing web directories.

Shadow IT and the OT Exposure Radius

Node-RED is widely deployed as integration middleware across both enterprise IT and industrial IoT (IIoT) environments. It is routinely used by process engineers, building automation technicians, and operational teams to rapidly connect physical hardware to databases, message brokers, and enterprise management tools. Because these deployments frequently occur outside formal IT procurement and security review processes, many instances remain uninventoried and directly accessible from the public internet on default port 1880.

The operational placement of Node-RED makes a compromised instance uniquely dangerous:

• Protocol Bridging: A single instance typically communicates across disparate protocols—speaking Modbus, OPC UA, MQTT, or Siemens S7 to field equipment on one side, and HTTP, SQL, or cloud APIs on the other.
• Implicit Trust and Credential Vaults: To bridge these networks, Node-RED flows store hardcoded database credentials, API tokens, and control system passwords. Compromising the editor exposes these secrets in cleartext.
• Cross-Boundary Pivoting: Node-RED frequently bridges the gap between segmented IT networks and operational technology (OT) zones, creating an unmonitored bridge across network perimeters.

Recent campaigns mirror similar widespread attacks against exposed infrastructure equipment, where unauthenticated management interfaces placed on public networks become immediate targets for automated botnets.

Operational Risks and Patching Delays

Siemens issued security advisories for its embedded Node-RED products on August 11, 2026, alongside general project guidance urging administrators to enforce authentication. However, the operational reality of OT maintenance creates a significant lag between vulnerability disclosure and remediation.

While enterprise IT environments often enforce rapid patch cycles, industrial control networks rely on pre-planned maintenance windows. Firmware updates for IIoT gateways and industrial controllers must undergo extensive compatibility testing to prevent unintended operational downtime. An 11-week window between patch publication and observed active exploitation is often insufficient for OT security teams, leaving a substantial population of industrial gateways unpatched and exposed.

Furthermore, current exploitation patterns appear largely opportunistic rather than hyper-targeted towards specific industrial processes. Automated botnets scan mass IP ranges seeking generic Linux execution environments to expand DDoS capacity or mining operations. However, uncurated malware executing on an IIoT gateway can severely exhaust system RAM, saturate low-bandwidth serial/industrial communications, or crash real-time controllers—causing severe operational disruption even without intent to sabotage critical infrastructure.

Remediation and Incident Response

Closing the underlying vulnerability requires immediate administrative configuration changes and host-level auditing, as simply applying a firmware update or software patch will not remove backdoors established prior to remediation.

1. Enable Admin Authentication: Node-RED does not enable authentication out of the box. Administrators must modify the settings.js file to uncomment and configure the adminAuth block, enforcing strong multi-factor or bcrypt-hashed password authentication for the flow editor and API endpoints.
2. Restrict Network Reachability: Remove Node-RED administrative endpoints (default port 1880) from public internet exposure immediately. Enforce strict firewall rules, placing instances behind an authenticated reverse proxy or requiring a zero-trust network access (ZTNA) agent / VPN for editor access.
3. Audit Active Flows and System Processes: Inspect running flows within existing deployments for unauthorized exec or function nodes executing system-level shell commands (e.g., curl, wget, sh, bash).
4. Conduct Backdoor and Shell Hunts: Because attackers have been observed leaving web shells behind to maintain persistent access, inspect underlying web directories, system startup scripts, and temporary folders (/tmp, /var/tmp) for suspicious ELF binaries or web scripts.
5. Rotate Connected Credentials: Treat any unauthenticated Node-RED instance exposed to the internet as a full credential compromise. Immediately rotate all API keys, database passwords, MQTT credentials, and industrial controller access tokens managed within the instance’s flow configuration files.