CVE-2026-58115: Node-RED OT Flaw Exploited in Linux Malware Attacks

Operational technology and industrial control system environments face an immediate threat as attackers exploit a maximum-severity flaw in Node-RED, a flow-based programming tool deployed widely across critical infrastructure. Tracked as CVE-2026-58115 and assigned a perfect 10.0 CVSS score by Siemens in August 2026, the vulnerability arises from a complete absence of authentication on the Node-RED HTTP interface in affected commercial products. Threat intelligence telemetry indicates that malicious actors are weaponising this oversight via automated mass scanning, delivering entire exploit chains in single HTTP POST requests to deploy Linux botnet payloads.

The convergence of IT and OT networks compounds the risk profile of embedded edge gateways. Because these devices often bridge local industrial fieldbuses with broader corporate or cloud telemetry pipelines, an unauthenticated administrative interface exposes core operating system execution primitives directly to the public internet. Security teams must treat internet-facing operational software as critical perimeter assets, decoupling convenience-oriented development tools from production execution contexts.

Anatomy of CVE-2026-58115: Unauthenticated RCE in Node-RED

Node-RED is a programming tool built on top of Node.js that enables developers and engineers to wire together hardware devices, APIs, and online services using a browser-based visual flow editor. While designed to streamline workflow automation, its underlying architecture relies on an HTTP server that exposes management endpoints for deploying and modifying application logic. In commercial industrial control products such as the Siemens SIMATIC IoT2050, vendor integration packages have historically failed to enforce authentication on this HTTP interface out of the box.

The absence of access controls means that any network peer able to reach the management port can read, write, and execute arbitrary flow configurations without presenting credentials. Siemens assigned CVE-2026-58115 with a CVSS score of 10 out of 10 because the vulnerability allows unauthenticated remote attackers to achieve administrative code execution on the underlying host operating system. The software executes deployed flows immediately within the context of the Node.js runtime process, granting attackers the same privilege level as the service user running the gateway daemon.

Underlying Node.js Runtime Dynamics

The technical mechanism permitting remote execution stems from how Node-RED serialises and compiles flow specifications into active JavaScript execution contexts. When a client issues a configuration update, the Node-RED server parses the incoming JSON payload into internal flow objects. Nodes designed for utility tasks or operating system integration instantiate child processes using standard asynchronous execution wrappers provided by the Node.js core library, specifically child_process.exec or child_process.spawn.

Without an authorization layer guarding the /flows REST API endpoint, the service accepts state modifications from any socket connection. The runtime engine does not validate whether the source of the deployment request holds administrative privileges, nor does it sanitize shell metacharacters embedded within node parameter properties. Consequently, an attacker who crafts a flow containing operating system commands bypasses all boundary checks.

Trivial Weaponisation: The Inject and Exec Node Chain

Exploiting the vulnerability requires no complex memory corruption or privilege escalation chains. Attackers leverage native functionality built directly into the Node-RED core engine. Specifically, the exploit relies on the interaction between two standard nodes: the inject node and the exec node.

The inject node generates operational messages containing predefined payloads, timestamps, or trigger signals. It can be configured to fire automatically upon application startup or on a repeating schedule. The exec node accepts incoming flow messages, passes specified parameters to the underlying operating system shell, and captures standard output streams. Wiring an inject node directly to an exec node creates an execution pipeline that fires automatically the moment the flow deployment completes, requiring zero human interaction or manual button clicks from an operator.

Malicious actors package this combination into a single API payload. Rather than staging an attack across multiple interactive sessions, threat actors transmit the complete exploit structure directly via an HTTP POST request to the management endpoint, instructing the runtime environment to download and execute external staging scripts.

# Example conceptual representation of a malicious flow payload structure delivered via POST
curl -X POST -H "Content-Type: application/json" -d @malicious_flow.json http://<target-gateway-ip>:1880/flows

Note: Test all diagnostic queries and configuration audits in a non-production staging environment before deploying to live operational networks.

Flow Payload Structure Analysis

To understand the mechanics of the deployed payload, security analysts must examine the JSON schema accepted by the Node-RED runtime. A malicious flow definition consists of an array of node objects where an inject node references the identifier of an adjacent exec node. The exec node’s configuration object holds the exact command string destined for the shell.

When the HTTP server processes the incoming POST request, it replaces the existing active flow with the new array. The Node-RED runtime engine iterates through the registered nodes, initialising each one. Because the inject node’s properties specify an immediate startup trigger, it dispatches an empty message object down the wire into the exec node’s input port. The exec node immediately invokes the system shell with the attacker-supplied command arguments, completing the execution cycle entirely in memory without writing unauthorized configuration files to persistent storage if run from volatile instances, though standard installations write the flow to disk.

In-the-Wild Exploitation and Threat Intel Telemetry

Active exploitation of CVE-2026-58115 was captured by VulnCheck researchers beginning on 30 October 2026, as reported by The Register. Telemetry from public-facing canary networks revealed that malicious traffic originated from a single IP address—4.201.105[.]116—situated within Microsoft’s AS8075 autonomous system in Brazil. Rather than conducting tentative reconnaissance, this source transmitted the complete exploit, flow logic, and dropper mechanism in a single POST /flows transaction.

Between 30 October and 1 November 2026, the scanning infrastructure targeted the Node-RED flaw 16 times while logging a total of 125 hits across eight distinct CVEs. The broader scan campaign encompassed legacy and modern vulnerabilities alike, including the seven-year-old Apache Solr remote code execution flaw tracked as CVE-2019-17558, which affects platforms such as Camunda, Gitea, MLflow, Traefik, and Joomla. This broad dispersal of exploit signatures indicates opportunistic mass scanning by automated botnets rather than targeted state-sponsored espionage against specific industrial facilities.

Reconnaissance versus Automated Propagation

The statistical breakdown of the telemetry highlights a distinct operational tempo maintained by the attacking infrastructure. Rather than querying the target to determine software versions or architectural specifics before launching an exploit, the scanning source fires weaponised payloads indiscriminately. This behaviour matches standard worm-like propagation mechanics where efficiency and breadth supersede precision.

Security analysts investigating perimeter logs should expect to find high-frequency scanning patterns targeting port 1880 alongside other common administrative ports. The inclusion of CVE-2019-17558 in the same telemetry stream demonstrates that botnet operators maintain broad libraries of exploitation modules, cycling through disparate software stacks to identify unpatched systems regardless of whether those systems reside in enterprise DMZs or operational enclaves.

The Scan-and-Infect Architecture and Dropper Analysis

Analysis of the threat infrastructure highlights a common modular design pattern in modern Linux botnet campaigns: the separation of reconnaissance and exploitation infrastructure from payload distribution servers. While the exploitation requests originated from Microsoft’s network in Brazil, telemetry associated with one of the attack iterations directed target devices to download binaries from a separate server hosted at 85.215.73[.]250.

The specific malware binary identified in the attack telemetry carried the filename bot-linux-amd64. This naming convention explicitly indicates a target architecture running Linux on 64-bit AMD/Intel processors, typical of high-end industrial gateways and edge compute boxes. However, researchers noted that because the binary itself was not successfully retrieved during the initial canary encounters, the exact post-exploitation routines, persistence mechanisms, and secondary payloads remain unconfirmed. The specific file nomenclature also strongly suggests that threat operators maintain parallel builds tailored for alternative architectures common in embedded environments, such as ARM or MIPS.

Payload Retrieval Mechanics

In a typical scan-and-infect execution chain, the initial exploit payload delivered via the Node-RED exec node does not contain the entire botnet binary within its argument string. Instead, the shell command executes a lightweight retrieval utility—such as curl or wget—pointing to the separate download server. The remote script fetches bot-linux-amd64, changes file permissions to make the binary executable, and launches the process in the background.

This decoupling protects the primary scanning nodes from blacklisting. If defenders block the IP address responsible for sending exploitation requests, the secondary download server remains operational, servicing successfully infected victims. Incident responders must therefore correlate firewall logs across multiple external IP ranges when performing root-cause analysis on compromised gateways.

The Convergence of IT and OT Threat Exposure

The exploitation of CVE-2026-58115 underscores the hazards introduced by bridging enterprise information technology practices with operational technology infrastructure. Industrial IoT gateways are frequently deployed at the edge of manufacturing plants, energy substations, and municipal water facilities to aggregate sensor data and communicate with cloud-based dashboards. When these gateways are provisioned with default configurations, local developer tooling often remains exposed to wide area networks.

Recent historical incidents demonstrate the physical consequences of such exposures. Attacks on water treatment facilities across multiple US states and widespread refrigeration controller compromises across Europe illustrate that attackers actively scan for vulnerable edge devices to gain footholds in OT perimeters. Once inside, malware can manipulate control loops, disrupt environmental parameters, or serve as a pivot point for lateral movement into air-gapped industrial control networks.

Architectural Silos and Visibility Deficits

A primary challenge in securing operational technology environments stems from visibility deficits between IT and engineering teams. IT departments often lack asset inventories for embedded edge devices deployed within industrial plants, while plant operators may lack the security tooling necessary to detect unauthorized HTTP requests or abnormal process spawns on headless Linux gateways.

When software development kits and rapid prototyping tools like Node-RED are deployed into production units without stripping out management interfaces, the attack surface expands dramatically. Addressing this convergence requires enforcing strict network segmentation between supervisory control and data acquisition (SCADA) networks and corporate IT backbones.

Detection Engineering and Telemetry Signatures

Detecting active exploitation attempts against Node-RED installations requires monitoring both network traffic perimeters and host-level process execution anomalies. Because the attack vector relies on an HTTP POST request containing flow definitions that invoke shell commands, security analysts can construct specific detection rules across SIEM and web application firewall platforms.

Network Detection Rules

Inspect incoming HTTP traffic to Node-RED management ports (typically TCP port 1880) for anomalous payload structures. Look for HTTP requests targeting the /flows endpoint containing JSON bodies that instantiate exec, process, or command nodes.

# Example Suricata or Snort signature concept for POST /flows inspection
alert tcp any any -> any 1880 (msg:"NODE-RED Unauthenticated Flow Deployment Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/flows"; http_uri; content:"exec"; fast_pattern; classtype:attempted-admin; sid:1000001; rev:1;)

Host-Level Monitoring

On Linux-based OT gateways, monitor process creation events originating from the Node.js runtime interpreter. A healthy Node-RED instance should not spawn child processes associated with shell utilities like sh, bash, wget, or curl during routine flow execution.

# Audit active child processes spawned by node processes (test in staging)
ps -ef | grep node
# Inspect parent-child process trees using auditd or systemd logs
journalctl -u nodered -b --follow

Log Analysis and Querying

Security operations teams should ingest web server access logs and system audit trails to hunt for historical compromise indicators. Querying web access logs for suspicious method calls and URI patterns provides immediate insight into whether external entities have probed management endpoints.

# Example grep query to inspect web access logs for POST requests to flow endpoints
grep "POST /flows" /var/log/nodered/access.log

Hardening and Remediation Playbook

Securing vulnerable Node-RED environments requires a structured, prioritized remediation approach combining network segmentation, credential enforcement, and application hardening.

1. Immediate Network Isolation: Verify whether Node-RED interfaces are accessible from untrusted networks. Drop external ingress traffic destined for port 1880 at the firewall perimeter immediately.
2. Apply Vendor Patches: Install updated firmware and software packages supplied by Siemens and other downstream vendors addressing CVE-2026-58115.
3. Enforce Authentication: Configure authentication settings within the Node-RED configuration file (settings.js) to require administrative credentials for editor access and deployment APIs.
4. Implement Reverse Proxy Access Controls: Place Node-RED behind a hardened reverse proxy (such as Nginx or Apache) enforcing mutual TLS (mTLS) or robust OIDC authentication before requests reach the local service port.
5. Audit Execution Nodes: Review existing production flows and remove unneeded execution primitives such as exec, spawn, or system command nodes from operational environments.

Configuration Hardening Worked Example

To secure a standalone Node-RED installation against unauthenticated flow deployment, administrators must modify the configuration file typically located at ~/.node-red/settings.js. Below is an excerpt demonstrating how to enable password authentication using bcrypt hashing for administrative access.

// Excerpt from settings.js for administrative authentication enforcement
module.exports = {
    adminAuth: {
        type: "credentials",
        users: function(username) {
            return new Promise(function(resolve) {
                if (username === "admin") {
                    resolve({ username: "admin", permissions: "*" });
                } else {
                    resolve(null);
                }
            });
        },
        authenticate: function(username, password) {
            // Validate password against hashed secret using bcrypt
            return bcrypt.compare(password, hashedPassword);
        }
    },
    editorTheme: {
        projects: {
            enabled: false
        }
    }
};

Key Takeaways for Infrastructure and Security Leaders

The active exploitation campaign targeting CVE-2026-58115 highlights critical lessons for enterprise and industrial security architecture. Trust boundaries in converged IT/OT environments must be continuously re-evaluated; convenience features intended for development environments should never persist in production deployments. Furthermore, the velocity of automated mass scanning means that newly disclosed vulnerabilities in embedded software are weaponised within days of disclosure. Infrastructure leaders must prioritize continuous external attack surface management, rigorous asset discovery, and defense-in-depth engineering for all edge computing hardware.

Securing modern edge infrastructure requires moving beyond perimeter trust models. Because industrial gateways frequently handle critical control functions, hardening must occur at every layer—from operating system access controls and application authentication settings to network segmentation and egress filtering. By implementing the detection rules and hardening playbooks outlined above, security teams can significantly reduce their exposure to automated botnet campaigns and emerging OT threats.

Frequently asked questions

What is CVE-2026-58115 and why does it have a CVSS score of 10?

CVE-2026-58115 is a critical vulnerability affecting the HTTP management interface of Node-RED in industrial devices. It received a maximum CVSS score of 10 out of 10 because it allows unauthenticated remote attackers to execute arbitrary system commands on the host operating system instantly, requiring no credentials or user interaction.

Which devices and software environments are affected by the Node-RED flaw?

The vulnerability impacts commercial products that embed Node-RED for workflow automation without enforcing HTTP interface authentication out of the box. This includes specific industrial control systems and edge gateways such as the Siemens SIMATIC IoT2050. Any deployment exposing the Node-RED management port to untrusted networks is vulnerable.

How do attackers weaponize Node-RED built-in nodes for remote code execution?

Attackers combine built-in automation primitives by wiring an inject node directly to an exec node within a malicious flow configuration. Because Node-RED automatically evaluates and executes newly deployed flows immediately upon receipt, transmitting this flow via an HTTP POST request triggers the embedded shell commands without human interaction.

What indicators of compromise are associated with the active botnet campaigns?

Key indicators identified by threat intelligence researchers include exploitation traffic originating from IP address 4.201.105[.]116 in Microsoft’s AS8075 network, targeting of the POST /flows API endpoint, payload downloads originating from server 85.215.73[.]250, and the appearance of malware binaries named bot-linux-amd64.

What immediate steps should system administrators take to secure exposed instances?

Administrators should immediately verify that Node-RED interfaces are not exposed to the public internet, apply vendor-supplied updates and patches, enforce strong administrative authentication inside the Node-RED configuration, place instances behind authenticated reverse proxies, and audit production flows to remove unneeded execution nodes.