Security · November 5, 2026
Node-RED servers infected with malware via critical vulnerability
Attackers exploit a critical vulnerability in the programming tool Node-RED to infect servers with malware. This is reported by the cybersecurity company Vulncheck. Siemens announced the existence of the vulnerability (CVE-2026-58115) in August and stated that updates to address the issue were also available. Node-RED is a low-code visual programming tool designed to easily connect devices and applications and automate tasks. It is used in industrial environments, as well as in the Internet of Things and home automation.
CVE-2026-58115 pertains to the lack of authentication within the Node-RED HTTP interface. An unauthenticated attacker can gain access to programming nodes that can execute system commands on the server. Through a malicious Node-RED flow, an attacker can execute arbitrary code with maximum privileges on the underlying server, according to the security bulletin from Siemens. The CVSS impact score of the vulnerability has been assessed at 10.0 on a scale of 1 to 10.
Siemens uses Node-RED on the SIMATIC IoT2050 gateway. According to Siemens, the IoT gateway is designed to make existing factories Industrial Internet of Things ready without requiring hardware or software modifications. Cybersecurity company Vulncheck reports that attackers are exploiting CVE-2026-58115. Through a malicious flow, the vulnerable Node-RED server will download and execute malware from the attackers' server. This includes a Linux bot and a web shell that acts as a backdoor. The current objective of the attackers remains unknown.