Max-severity bug in widely used OT programming tool exploited to deliver Linux malware

Max-severity Bug in Widely Used OT Programming Tool Exploited to Deliver Linux Malware

🚨 Attention all Node-RED users! 🚨 Unknown criminals are exploiting a maximum-severity vulnerability in Node-RED, a flow-based programming tool widely used in critical infrastructure, to deploy a flow that downloads and runs a Linux bot. Node-RED is commonly utilized for workflow automation in industrial control systems (ICS) and operational technology (OT) environments.

In August, Siemens assigned the vulnerability identifier - CVE-2026-58115 - to describe the bug, which has a perfect 10-out-of-10 CVSS rating.

What’s the Issue?

Affected Siemens devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that can execute system commands on the device. This means that unauthenticated remote attackers can create malicious flows.

VulnCheck researchers began documenting this vulnerability last Friday. On October 30, 2026, one of their canaries caught an attacker exploiting CVE-2026-58115. According to VulnCheck researcher Patrick Garrity, two Node-RED built-in nodes make this vulnerability “trivial to weaponize.” One is an inject node, which fires a message either on a schedule or once at startup. The second, an exec node, can run shell commands.

“Wire one to the other and the flow executes a command as soon as it is deployed, with no further interaction,” Garrity explained.

Attack Details

The activity observed by VulnCheck came from a single IP address, 4.201.105, which geolocates to Brazil. This IP address targeted the same Node-RED vulnerability 16 times between October 30 and November 1, logging 125 hits against eight different CVEs across their wider canary network. Among the targets was a seven-year-old Apache Solr flaw tracked as CVE-2019-17558.

Recommendations

If you run Node-RED anywhere, including inside OT environments, check today whether it’s reachable from outside your network, apply updates where available, and implement detections to reduce the risk of exploitation. While the bug has been added to VulnCheck’s Known Exploited Vulnerabilities (KEV) catalog, it hasn’t appeared (as of press time) in the US Cybersecurity and Infrastructure Security Agency’s KEV.

For more details, Read full article.