Attackers are hitting Node-RED with a single request. A score of 10 out of 10.

SecurityWeek reports CVE-2026-58115, a CVSS 10 missing-authentication flaw in the Node-RED HTTP interface, is exploited, with VulnCheck seeing attacks from 30 October and 15 more by 1 November, some leaving webshells. Siemens fixed it in SIMATIC IoT2050 Advanced 4.3.4.1. Attackers scan for Node-RED without adminAuth.

Node-RED can run system commands. An editor open to the network is a shell for whoever finds it first, on a small box or a server.

If you run Node-RED, check that adminAuth is on and the editor is not reachable from the internet. On Siemens IoT2050 devices, update to 4.3.4.1 or later.