VulnCheck reports that a known critical flaw in Node-RED has been exploited. The vulnerability could allow unauthenticated attackers to execute code on affected servers.
Node-RED is a flow-based programming environment used for automation in industrial control systems and operational technology. The tool is built on top of Node.js and is used in products including Siemens SIMATIC IoT2050. Siemens reported the authentication-related vulnerability (tracked as CVE-2026-58115, with a severity score of 10 out of 10) in August 2026, and VulnCheck researchers have now observed attacks that exploit the flaw.
According to Patrick Garrity in the VulnCheck report, “Node-RED instances without ‘adminAuth’ are being found and exploited automatically, and a deployment takes one HTTP request. If you run Node-RED anywhere, including embedded in your ICS/OT environment, check whether it can be reached from outside your network today.”
Read more at VulnCheck and see the documentation for details on securing Node-RED.
