Node-RED CVE-2026-58115 exploited in wild to deploy Linux bots

1. Executive summary

VulnCheck canary infrastructure recorded exploitation of CVE-2026-58115 on 30 October 2026, when a single request to the Node-RED POST /flows endpoint deployed a flow that downloaded and ran a Linux binary named bot-linux-amd64. The flaw is missing authentication on the Node-RED HTTP interface, scored CVSS 10.0 CRITICAL in NVD and recorded there as CWE-306; it is not in CISA KEV, and EPSS stands at 1%. Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED before V4.3.4.1 are affected, and any Node-RED instance without adminAuth that is reachable from the internet is exposed regardless of vendor. The binary was never retrieved, so its function is unknown, and the activity is described by VulnCheck as opportunistic mass scanning rather than a targeted campaign. EMEA financial services exposure is indirect: Node-RED is common in manufacturing, healthcare and building automation, so the risk sits in third-party and supplier OT estates and in any internet-facing Node-RED used for internal automation, not in core banking systems.

2. Regulatory framing

3. Technical analysis & attack chain

The exploitation VulnCheck observed follows a short, confirmed sequence:

1. The attacker sends a single POST /flows request to a Node-RED instance that does not enforce authentication on its HTTP interface.
2. The request body is a complete Node-RED flow, wrapped in three layers of encoding, that the instance accepts and deploys.
3. The flow wires an inject node to an exec node. The inject node fires on deployment or at startup; the exec node runs a shell command. The command executes as soon as the flow is deployed, with no further interaction.
4. The command downloads a file named bot-linux-amd64 from an attacker-controlled server, saves it under a hidden name in a memory-backed location, and runs it in the background.

The vulnerability is missing authentication for a critical function (CWE-306). Siemens states that affected devices do not enforce authentication on the Node-RED HTTP interface, which allows unauthenticated access to programming nodes capable of executing system commands, so an unauthenticated remote attacker can create malicious flows and execute arbitrary code on the underlying server with maximum privileges. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Affected are SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed, in versions before V4.3.4.1. The vendor fix is V4.3.4.1 or later. Siemens also lists hardening the Node-RED installation per the Node-RED User Guide and uninstalling Node-RED as mitigations.

Later requests from the same source carried different payloads. One fetched a shell script from the same download server. Another pulled a file from a second server and saved it under a name made to look like a kernel worker thread. Several requests installed webshells that let the attackers return and run commands at will. The bot runs from memory and is lost on reboot unless it establishes persistence by some other means; the webshells survive a restart.

VulnCheck did not retrieve the binary or the staged scripts, so what bot-linux-amd64 does once running is not stated in public reporting. The filename indicates a Linux build for AMD64 processors and suggests the operator may hold other builds. Whether it is a cryptominer, a DDoS bot, a reverse shell or something else is unknown.

The source address was a single IP, 4.201.105[.]116, in Microsoft's AS8075 network, geolocating to Brazil. Between 30 October and 1 November 2026 that address hit the Node-RED flaw 16 times and, in VulnCheck's wider canary data, logged 125 hits against eight CVEs across Apache Solr, Camunda, Gitea, MLflow, Traefik and Joomla. The Register reports one of those as CVE-2019-17558, a seven-year-old Apache Solr flaw. A second payload server, 85.215.73[.]250, was used for at least one download; VulnCheck holds only the URL for it and no other telemetry. The split between the host that sends the exploit and the host that serves the implant is consistent with a scan-and-infect arrangement in which finding hosts pull the implant from a dedicated server.

Attribution is unconfirmed. No source names an actor, and the activity is characterised by VulnCheck as opportunistic mass scanning rather than a targeted attack. Garrity notes that an address in a large cloud provider's range is usually a rented or compromised virtual machine and says little about who is behind the attacks. The exploitation finding and the indicator set rest on VulnCheck's reporting alone; treat them as single-sourced and verify before enforcement.

4. Mitigation & containment

P1, within 24 hours

• Inventory every Node-RED instance, including those embedded in OT products such as SIMATIC IoT2050 Advanced, and determine which are reachable from outside the network. VulnCheck's guidance is to check reachability today.
• Remove internet exposure from any Node-RED HTTP interface that does not need it. CISA recommends minimising network exposure for control system devices, placing control system networks and remote devices behind firewalls and isolating them from business networks.
• Where remote access is required, CISA recommends VPNs, with the caveat that VPNs may have vulnerabilities and should be updated to the most recent version.
• Search Node-RED logs for POST /flows requests from 4.201.105[.]116 and for outbound connections to 85.215.73[.]250. On any host that shows either, treat the instance as compromised: capture the deployed flows, look for webshells that survive restart, and look for a hidden process running from a memory-backed path.

P2, within 72 hours

• Update SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED to V4.3.4.1 or later, per the Siemens advisory at https://support.industry.siemens.com/cs/ww/en/view/109741799/.
• Where the update cannot be applied immediately, apply the Siemens mitigations: harden the Node-RED installation per the Node-RED User Guide, or uninstall Node-RED.
• Enable adminAuth on any Node-RED instance that lacks it. VulnCheck's warning is specific: instances without adminAuth are being found and exploited automatically.

P3, within 7 days

• Add detection for the flow pattern in §6 to Node-RED and host monitoring.
• Ask OT and automation suppliers whether they ship Node-RED and which version, and record the answer against the DORA Art. 28 and NIS2 Art. 21(2)(d) obligations in §2.
• Reboot remediated hosts after confirming no webshell remains, since the bot itself does not survive a restart but the webshells do.

No fixed release for Node-RED itself, as distinct from the Siemens product update, is named in public reporting.

5. Indicators of compromise

ipv4  4.201.105[.]116
ipv4  85.215.73[.]250
filename  bot-linux-amd64

The IPs sit in Microsoft's AS8075 and a second hosting range respectively; both are attacker infrastructure per VulnCheck, not legitimate services. The full IOC list is in the VulnCheck post, which was not available here; the values above are those carried in the reporting.

Behavioural indicators

6. Detection

The sources give no file hashes and no command strings, so the YARA rule below keys on the one artefact the reporting names, the dropped filename. It will match the binary only if that name is embedded in it; it is a weak pivot and should be paired with the Sigma rule.

rule NodeRED_CVE_2026_58115_LinuxBot
{
    meta:
        author = "Adverse Trace"
        date = "2026-11-04"
        reference = "https://www.helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation/"
        description = "Matches the bot-linux-amd64 filename associated with CVE-2026-58115 exploitation. No hashes or command strings were available; low-confidence pivot."
    strings:
        $name = "bot-linux-amd64" ascii wide
    condition:
        uint32(0) == 0x464c457f and $name
}

title: Node-RED POST /flows exploitation attempt (CVE-2026-58115)
id: 8f3c2a1e-6b4d-4c9a-9e21-7d5a0b3c4e11
status: experimental
description: Detects a POST to the Node-RED flows endpoint from the source address reported by VulnCheck, or a flow deployment that wires an inject node to an exec node.
author: Adverse Trace
date: 2026-11-04
references:

    - https://www.helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation/
logsource:
    category: webserver
detection:
    selection_path:
        cs-method: 'POST'
        cs-uri-stem: '/flows'
    selection_src:
        c-ip: '4.201.105.116'
    condition: selection_path and selection_src
falsepositives:

    - Legitimate flow deployments from the same address if it is ever reassigned
level: high

A second rule should alert on any POST /flows that deploys a flow containing both an inject and an exec node from an unauthenticated session; the sources do not give the JSON field names, so that rule must be built against the local Node-RED flow schema rather than from this advisory.

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

7. Sources

• Help Net Security, "Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)", https://www.helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation/, 2026-11-03
• The Register, "Max-severity bug in widely used OT programming tool exploited to deliver Linux malware", https://www.theregister.com/security/2026/11/02/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware/5307086, 2026-11-02
• CISA ICS Advisory ICSA-26-237-03, "Siemens SIMATIC IoT2050 Advanced", https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-03
• Siemens ProductCERT advisory, https://support.industry.siemens.com/cs/ww/en/view/109741799/
• The Hacker News, "Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors", https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html
• SecurityWeek, "Critical Node-RED Flaw Exploited in Attacks", https://www.securityweek.com/critical-node-red-flaw-exploited-in-attacks/

8. Adverse Trace position

Adverse Trace assesses CVE-2026-58115 as CVSS 10.0 CRITICAL per NVD, not in CISA KEV, with EPSS at 1%, and exploited in the wild since 30 October 2026 on the evidence of VulnCheck's canary network. The exploitation detail and indicators are single-sourced to VulnCheck and should be verified before enforcement. Client impact for EMEA financial services is low to moderate and indirect: the confirmed victims are internet-exposed Node-RED instances, and the path into a financial firm runs through OT and automation suppliers and through any internal Node-RED left reachable. The unknown payload function is the main open question, and it caps how far the impact assessment can go. We will monitor for a CISA KEV listing, for VulnCheck's full IOC post, and for any analysis of bot-linux-amd64, and we will update this advisory if the payload is characterised or the exploitation scope widens. Clients should confirm Node-RED reachability and version status now and report back against the DORA Art. 28 and NIS2 Art. 21(2)(d) supplier checks in §2.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.