> ## Content Index
> Fetch the complete content index at: https://stackurity.ai/blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# Node-RED flaw CVE-2026-58115 is exploited to drop a Linux bot
- URL: https://stackurity.ai/blog/node-red-cve-2026-58115-exploited-linux-bot/
- Published: 2026-11-04T07:35:05.000Z
- Updated: 2026-11-04T07:35:05.000Z
- Description: Attackers exploit CVE-2026-58115 in Node-RED to install a Linux bot and backdoors. See who is affected and how to check your servers.
- Author: Stackurity Research Team
- Tags: Linux Servers, News

**TL;DR:** Attackers are exploiting CVE-2026-58115, a missing-authentication flaw in Node-RED, to put a Linux bot and backdoor access on servers left unprotected. If Node-RED is reachable on any of your machines, make sure its editor requires a login.

## What happened

On November 3, 2026, [Help Net Security reported](https://www.helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation/) that VulnCheck has seen real attacks on CVE-2026-58115\. Node-RED is a browser-based tool, built on Node.js, for wiring together event-driven applications, and it also ships inside some industrial products. The attackers go after servers with no protection and leave a bot and backdoors behind.

The [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-58115) describes the flaw in a Siemens industrial device: the Node-RED web interface does not enforce authentication, so a remote visitor can build flows that run system commands. It carries a CVSS v3.1 score of 10 from Siemens ProductCERT. Siemens lists affected devices as those running versions before V4.3.4.1.

## Am I affected?

You are in scope if a Node-RED editor or its HTTP interface is reachable without a login, on a device or on a server you run yourself. A quick look at what listens on a Linux host: `ss -tlnp`. Then confirm in Node-RED's own settings that the editor needs credentials, and keep it off the public internet. For vendor devices, follow the vendor advisory for the fixed firmware.

## How to check with Stackurity

Stackurity does not cover appliance firmware, so the Siemens device itself is outside its scope. For Node-RED that you installed on a Linux server, the read-only agent inventories installed software and the libraries deployed applications load, and repository lockfiles can be matched against advisories. It cannot tell you whether an editor is exposed without a login, so treat the configuration check above as separate. See [how fixes are tracked](https://stackurity.ai/docs/remediation) in the docs. Stackurity Cloud has a 14-day free trial without a card: [start a free trial](https://app.stackurity.dev/signup?utm%5Fsource=blog&utm%5Fmedium=referral&utm%5Fcampaign=linux-servers&utm%5Fcontent=node-red-cve-2026-58115-exploited-linux-bot).