Package vulnerability, severity high

Node-RED critical auth flaw (CVE-2026-58115) exploited to deploy Linux bot and webshells

Published November 3, 2026

An authentication flaw (CVE-2026-58115, CVSS 10.0) in Node-RED lets an unauthenticated remote attacker create malicious flows and run arbitrary code on the server. VulnCheck observed in-the-wild exploitation starting October 30, 2026, which dropped a Linux bot binary and webshells on Node-RED instances without adminAuth. Siemens disclosed the flaw in August; its SIMATIC IoT2050 Advanced is affected on Industrial OS with Node-RED before V4.3.4.1.

What's affected

• node-red (npm)every version

Exposure window: 30 Oct 2026 00:00 UTC.

What to do

1. Check whether any Node-RED instance is reachable from outside your network
2. Apply available Node-RED updates
3. Enable adminAuth on all Node-RED instances
4. Look for the published indicators of compromise, including hidden binaries, unexpected flows and webshells, and add detections

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident node-red-auth-bypass-rce-2026-11

References

• https://www.helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation/

Notice node-red-auth-bypass-rce-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.