A 10.0 Node-RED Flaw Is Being Exploited in the Wild. Check Your Industrial Gateways Now

Node-RED RCE flaw scores a perfect 10.0

Security firm VulnCheck warned on November 2 that attackers are actively exploiting a critical Node-RED remote code execution flaw in the wild. Tracked as CVE-2026-58115, the vulnerability carries a maximum 10.0 CVSS score, and it lets unauthenticated remote attackers run arbitrary system commands on exposed hosts.

The flaw is a missing-authentication bug. Node-RED deployments running without administrative authentication enabled expose a web interface that attackers can reach directly. From there, they deploy malicious flows that drop Linux bot implants and install persistent webshells, particularly across operational technology networks where these devices manage real physical processes.

Siemens confirmed the impact on its SIMATIC IoT2050 Advanced gateways running Industrial OS before V4.3.4.1. The fix, Industrial OS V4.3.4.1, enforces authentication on the web interface. If you run one of these gateways, that update is not a someday task. It is a today task.

How the attacks work

Active exploitation began around October 30, according to VulnCheck's analysis. Attackers scan for exposed Node-RED instances, and researchers note that a deployment takes a single HTTP request to compromise once found. There is no phishing email to click, no password to steal. An open port and a missing login screen are enough.

Once in, attackers install flows that persist across restarts and give them a foothold inside industrial networks. That is the part that should worry operators most. These gateways often sit between IT networks and operational equipment, which means a compromised gateway can become a bridge into systems that were never meant to face the internet.

Who is affected

Any Node-RED deployment without admin authentication is at risk, but the confirmed product impact is Siemens SIMATIC IoT2050 Advanced gateways (model 6ES7647-0BA00-1YA2) on Industrial OS versions before V4.3.4.1. Standalone Node-RED instances are equally exposed if they were deployed for convenience and never locked down.

This is a depressingly common pattern in industrial deployments. A tool gets installed for a quick automation job, the web interface stays open for easy access, and nobody revisits the configuration until an incident forces the issue. If that describes any system you manage, treat this as your forced issue.

What to do right now

First, update Siemens IoT2050 gateways to Industrial OS V4.3.4.1 immediately. Second, for any standalone Node-RED instance, enable the adminAuth setting in settings.js so the editor and admin API require a login. Third, restrict web administration access to trusted networks only, ideally behind a VPN, and never expose the Node-RED editor directly to the internet.

Fourth, hunt. Check for unfamiliar flows, unexpected nodes, and new files on affected hosts. A patched gateway that still runs an attacker's flow is not a fixed gateway. If you find signs of compromise, assume credentials and connected systems may also be affected and investigate accordingly.

The same week brought other urgent patches, including the Cisco email gateway zero-day under active attack. If your patching queue is long, rank internet-exposed industrial systems at the top. They are the ones attackers find first, because scanning for them is trivial.

The lesson that keeps repeating

Every few months, a maximum-severity flaw turns out to be a missing login screen. The technology changes, the lesson does not: any web interface without authentication will eventually be found, and found quickly. Authentication is not a nice-to-have for admin panels. It is the entire security model.

If you are unsure whether your organization has exposed Node-RED instances, that uncertainty is itself the finding. Scan your own perimeter before someone else does, and check whether your data was already leaked while you are at it. The fix here is free, the update is available, and the exploitation is already happening. There is no version of this story where waiting helps.