{"id":10292,"date":"2026-11-04T03:33:57","date_gmt":"2026-11-04T03:33:57","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10292"},"modified":"2026-11-04T03:33:57","modified_gmt":"2026-11-04T03:33:57","slug":"node-red-authentication-hole-being-exploited-in-the-wild","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10292","title":{"rendered":"Node-RED authentication hole being exploited in the wild"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Months after Siemens released fixes for an authentication hole in flow-based programming tool Node-RED, it remains unpatched by many users and attackers are taking advantage of it in the wild.\u00a0<\/p>\n

The problem involves open source IoT\/IIoT systems, including those embedded in critical infrastructure, deployed outside the control of CISOs and CIOs. Security firm VulnCheck discovered the exploits and disclosed details in a blog post on Monday<\/a>.\u00a0<\/p>\n

\u201cOn October 30, 2026, one of our canaries caught an attacker exploiting CVE-2026-58115<\/a>, an unauthenticated Node-RED admin API flaw, to deploy a flow that downloads and runs a Linux bot. The request came from an IP in Microsoft\u2019s ASN (AS8075),\u201d the post said. \u201cWe have since seen 16 events from the same IP against this CVE, covering several different payloads.\u201d<\/p>\n

The core problem is that Node-RED ships with the authentication option disabled; users are supposed to change the setting before it goes live.\u00a0<\/p>\n

Patrick Garrity<\/a>, the VulnCheck security researcher who wrote the post, said the fact that Node-RED deployments are popular among those outside IT makes them susceptible to unsophisticated errors like this.\u00a0<\/p>\n

\u201cThey are put in place by relatively nontechnical people,\u201d Garrity said in an interview.<\/p>\n

Aman Mahapatra<\/a>, chief strategy officer for New York City-based technology consulting firm Tribeca Softech, said the Node-RED hole is not new, but it is still being leveraged in the wild.<\/p>\n

\u201cThe condition being exploited is one Node-RED has carried for years as a default: unless an administrator configures authentication, anyone who can reach the editor can deploy flows, and the project\u2019s own documentation says as much,\u201d he said. \u201cNode-RED is popular precisely because engineers can wire it up without involving IT, which also means it rarely appears in an asset inventory. It is the same pattern behind this week\u2019s supermarket refrigeration attacks<\/a>: equipment installed outside the security team\u2019s view, reachable from the internet, with authentication switched off.\u201d<\/p>\n

Mahapatra pointed out that the biggest danger is the nature of the way users tend to deploy Node-RED.\u00a0<\/p>\n

\u201cIt is integration middleware. A typical deployment speaks Modbus, OPC UA, MQTT or S7 to controllers on one side and to databases, brokers and cloud services on the other, and it stores credentials for all of them,\u201d he said. \u201cA compromised instance is a credential vault for every system it touches and a bridge across an IT\/OT boundary that the network diagram says does not exist.\u201d<\/p>\n

Another problem is that industrial system patches tend to happen on pre-planned schedules, rather than responding to emergent issues or suggested setting changes.<\/p>\n

\u201cSiemens published its advisory on August 11, and VulnCheck caught exploitation on October 30, three days after shipping its own detections,\u201d Mahapatra said. \u201cEleven weeks is a short runway in OT, where firmware updates wait for planned maintenance windows, so a meaningful share of affected gateways will remain unpatched well into next year.\u201d<\/p>\n

Frank Dickson<\/a>, principal analyst at Dickson Research, added that the details of the exploits are a good news\/bad news situation for CISOs. The good news is that the attacks did not appear to have targeted industrial systems. The bad news is the attackers found and accessed those systems anyway.<\/p>\n

Noah Kenney<\/a>, principal consultant at Digital 520, agreed.\u00a0<\/p>\n

\u201cThey don\u2019t necessarily need to understand the equipment or operations connected to these gateways. They\u2019re simply looking for systems capable of executing their commands,\u201d he said. \u201cThat creates a concerning possibility where industrial operations could be disrupted by attackers who never intended to target critical infrastructure in the first place. Even generic malware consuming system resources or interfering with network communications could have operational consequences.\u201d<\/p>\n

Dickson added that closing this hole may not resolve the exposure. \u201cThe report also found that some attackers skipped the bot and left web shells, hidden back doors for running commands later,\u201d Dickson said. \u201cPatching closes the door. It does not evict anyone already inside.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Months after Siemens released fixes for an authentication hole in flow-based programming tool Node-RED, it remains unpatched by many users and attackers are taking advantage of it in the wild.\u00a0 The problem involves open source IoT\/IIoT systems, including those embedded in critical infrastructure, deployed outside the control of CISOs and CIOs. Security firm VulnCheck discovered […]<\/p>\n","protected":false},"author":0,"featured_media":10293,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10292","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10292"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10292"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10292\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10293"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10292"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10292"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10292"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}