Node-RED flaw CVE-2026-58115 is exploited to drop a Linux bot

TL;DR: Attackers are exploiting CVE-2026-58115, a missing-authentication flaw in Node-RED, to put a Linux bot and backdoor access on servers left unprotected. If Node-RED is reachable on any of your machines, make sure its editor requires a login.

What happened

On November 3, 2026, Help Net Security reported that VulnCheck has seen real attacks on CVE-2026-58115. Node-RED is a browser-based tool, built on Node.js, for wiring together event-driven applications, and it also ships inside some industrial products. The attackers go after servers with no protection and leave a bot and backdoors behind.

The NVD entry describes the flaw in a Siemens industrial device: the Node-RED web interface does not enforce authentication, so a remote visitor can build flows that run system commands. It carries a CVSS v3.1 score of 10 from Siemens ProductCERT. Siemens lists affected devices as those running versions before V4.3.4.1.

Am I affected?

You are in scope if a Node-RED editor or its HTTP interface is reachable without a login, on a device or on a server you run yourself. A quick look at what listens on a Linux host: ss -tlnp. Then confirm in Node-RED's own settings that the editor needs credentials, and keep it off the public internet. For vendor devices, follow the vendor advisory for the fixed firmware.

How to check with Stackurity

Stackurity does not cover appliance firmware, so the Siemens device itself is outside its scope. For Node-RED that you installed on a Linux server, the read-only agent inventories installed software and the libraries deployed applications load, and repository lockfiles can be matched against advisories. It cannot tell you whether an editor is exposed without a login, so treat the configuration check above as separate. See how fixes are tracked in the docs. Stackurity Cloud has a 14-day free trial without a card: start a free trial.