Node-RED CVE-2026-58115: Single-POST Attempts to Deploy Linux Payloads and Webshells

1. Overview

• Article Title: Exploitation Targeting Node-RED, a Tool Embedded in ICS Products
• Source: VulnCheck
• Published Date: 2026-11-02
• Original: VulnCheck
• Related Sources: Siemens SSA-834709, SecurityWeek: Critical Node-RED Flaw Exploited in Attacks, Node-RED: Securing Node-RED
• Associated Malware: Unretrieved Linux bot payload
• Threat Actors: Unattributed
• Associated CVE: CVE-2026-58115
• Related Products: Node-RED; Siemens SIMATIC IoT2050 Advanced running Industrial OS with Node-RED installed (the officially affected configuration)
• Severity: critical

2. Executive Summary

Security firm VulnCheck reported observing active attack requests attempting to deploy Linux binaries or persistent webshells by automatically executing OS commands via a single POST /flows request, targeting a vulnerability (CVE-2026-58115) that allows unauthenticated deployment of Node-RED flow definitions. However, the observation was made against a honeypot (canary environment) operated by VulnCheck; successful compromises in production industrial control and IoT systems, as well as the specific functionalities of the unretrieved payloads, have not been confirmed.

Automated scanning exploiting paths leading to unauthenticated remote code execution has been observed, with a single source IP conducting broad scans across multiple vulnerabilities. While official impact has been confirmed for Siemens SIMATIC IoT2050 Advanced Industrial OS with embedded Node-RED, whether this CVE number applies under the same conditions across other vendor hardware or standalone Node-RED environments requires individual verification.

3. Attack Flow

Several variants of the observed attack requests exist, structured based on flow definitions sent to the canary environment.

Attack Variant	Initial Request	Execution Mechanism	Prerequisites and Characteristics
Variant A: External Downloader Type	Single POST /flows	An inject node triggers an exec node one second after deployment, executing a Base64-decoded shell command	Requires wget or curl, write and execution permissions in /dev/shm or /tmp, and outbound communication to an external payload server
Variant B: HTTP In Webshell Deployment	Single POST /flows	Creates a new HTTP In endpoint, registering a flow that passes input queries through a function node to an exec node	Does not require downloading external binaries; commands can be launched with Node-RED's OS privileges if the deployment creates a reachable HTTP endpoint. Preservation and removal of stored malicious flows are also necessary

Procedure from Single POST to Payload Execution and Webshell Deployment

1. Management API Discovery and Request Submission: An attacker scans for unprotected Node-RED management APIs exposed on the internet and sends a POST /flows containing a crafted JSON flow definition.
2. Execution Trigger Branching: In the downloader type, an inject node (once: true) sends a message one second after deployment, triggering the Base64-decoded shell execution embedded in the exec node command field. The webshell type does not require an inject node, instead using subsequent HTTP requests as execution triggers.
3. Command Execution and Subsequent Deployment:
   • Downloader Type: The downloader decodes the Base64 string and pipes it to sh. Depending on the variant, the command fetches and runs a Linux binary at /dev/shm/.b, a different payload at /tmp/.kworker, or the staged shell script wget.sh at /tmp/.s (executed with sh).
   • Webshell Type: Registers a new HTTP endpoint and operates a flow that executes parameters included in external web requests directly as OS commands.

4. Attacker Position and Execution Location

• The attacker sends requests from an external network with HTTP access to Node-RED's management port (default 1880, etc.). Additional payloads are downloaded from a separate attacker-controlled server.

5. Perspective of Victims and Administrators

Victim

• General OT and industrial automation personnel may not notice anomalies immediately; impacts may surface as increased CPU load on devices, unknown external traffic, or malfunctions in automation processes.

Administrator

• Observable indicators include POST /flows entries in Node-RED access logs, unexpected flow revision updates, the addition of unknown inject, exec, or http in nodes, hidden files created in /dev/shm or /tmp, and HTTP traffic destined for external IPs.

6. Success and Failure Conditions

Success Conditions

• The attacker has direct network access to the Node-RED management API, and authentication mechanisms such as adminAuth are not configured or are misconfigured, permitting flow modifications.
• The Node-RED process can launch an OS shell via the exec node. The downloader type requires outbound communication and execution permissions in specific directories, whereas the webshell type does not require outbound communication to fetch external payloads, but does require the attacker to reach the HTTP endpoint.

Failure Conditions and Mitigations

• Remove public internet exposure of the Node-RED editor and admin API. Enable authentication with adminAuth, and separately restrict network access with IP allowlists.
• Update Siemens SIMATIC IoT2050 Advanced Industrial OS to the patched version (v4.3.4.1 or later).
• Minimize Node-RED execution user privileges, restrict unnecessary use of exec nodes, writable directories, and outbound communication, and detect unknown flows by diffing against legitimate definitions.
• Note that while adminAuth protects editors and management APIs, authentication for already deployed HTTP In endpoints must be managed separately. Malicious flows must be completely removed, and authentication settings on HTTP nodes must also be verified.

7. What Happens Upon Success

• Arbitrary OS command execution under the Node-RED process execution privileges (root in some environments).
• Retrieval and execution of external Linux payloads. Specific functionalities remain unconfirmed as payloads were not retrieved.
• Establishment of a persistent webshell via HTTP endpoints on Node-RED.

8. Observable Logs

Inference: The following outlines potential log sources to investigate within your organization. This depends on log collection and retention settings and does not imply that all log outputs were confirmed in the primary source.

• Email: No observations specific to this incident in the primary source.
• Proxy / SWG / DNS: Management port access from source IPs identified during investigation (e.g., 4.201.105.116), and traffic destined for payload delivery servers (85.215.73[.]250:8080, 45.194.90[.]57:38472).
• Endpoint / EDR: Process clusters where Node.js processes spawn sh, wget, curl, chmod, setsid, and nohup. Suspicious executables such as /dev/shm/.b or /tmp/.kworker.
• Identity / IdP: Unknown sessions or login attempts in environments with authentication enabled. In unauthenticated environments, the absence of authentication logs itself becomes a blind spot.
• SaaS / Cloud: Security group and firewall rule change histories for cloud-hosted Node-RED instances.
• Network: Outbound HTTP traffic immediately following POST /flows requests, and requests destined for unknown HTTP In endpoints.

9. Attack Success Assessment

Attack Attempt Observed (Success Unconfirmed)

• Assessment Stage: Attack Attempt Observed (Success Unconfirmed) (contact_only) / Scope: VulnCheck canary environment telemetry
• Basis: VulnCheck's honeypot received attack requests and returned successful responses (HTTP 200), but there is no evidence of OS commands executing on production industrial equipment or confirmed payload infection facts, so it is not assessed as successful.

10. Investigation Playbook

Inference: The following is an incident investigation procedure for your organization.

Trigger

• Initiated by suspicious POST /flows requests targeting Node-RED, unexpected flow updates, or the detection of shells and download tools spawned from Node.js processes.

Initial Triage

• Verify source IPs, receipt timestamps, HTTP bodies (injected flow definitions), response codes, flow revisions, running Node-RED versions, and adminAuth configuration status.

Endpoint

• Preserve the process tree of the Node-RED host, stored flows.json, suspicious files in /dev/shm and /tmp, network sockets, and memory dumps.

Identity / Cloud

• Inspect reverse proxy configurations, cloud security groups, and management account authentication logs.

Subsequent Compromise

• Track access to deployed webshell endpoints, internal network scans, and whether abnormal commands were sent to industrial control (OT) protocols.

Containment

• Immediately restrict network access to the management ports. Preserve malicious flow definitions and related logs, then disable and remove the malicious flows while retaining the evidence. Restore legitimate flows from known-good backups, isolate the host, and apply patches.

Assessment

• Evaluate and separate the stages of scan contact, flow deployment, command invocation, payload retrieval, and webshell exploitation.

11. Defense and Detection Ideas

Single Event Detection

• Detect POST /flows requests from external networks that include exec nodes or inject nodes with once: true within flow definitions.

Timeline Correlation

• Perform timeline correlation analysis on flow definition updates, child process creation from Node.js, HTTP connections to external IPs, and the creation of unknown HTTP listeners.

Threat Hunting Perspectives

• Search all Node-RED environments within the organization for unauthenticated management consoles, usage of exec nodes, wired connections leading directly from HTTP In to exec, and known IOC files.

Logging Blind Spots

• In the absence of flow modification audit logs or reverse proxy access logs, it becomes difficult to retrospectively prove who injected what flows and when.

Priority Mitigations

• Prioritize hiding management interfaces from the public internet, enabling adminAuth, applying patches to embedded products such as SIMATIC IoT2050, and minimizing execution privileges.

12. Facts, Inference, and Hypothesis

Facts

• On October 30, 2026, VulnCheck observed unauthenticated POST /flows requests targeting CVE-2026-58115 in its canary environment, confirming 16 related events from the same IP by November 1.
• Attack requests included complete flow definitions designed to decode Base64 commands and pass them to a shell one second after deployment, utilizing wget or curl to fetch and execute Linux binaries.
• The same source IP conducted a total of 125 access attempts across eight different CVEs including Node-RED, exhibiting characteristics of indiscriminate mass scanning covering both old and new vulnerabilities.
• Additional requests included those deploying alternative payloads (.kworker) and registering webshell-type flows that accept arbitrary OS commands via query parameters.
• VulnCheck was unable to retrieve or analyze binaries, wget.sh, or .kworker, and specific functionalities such as reverse shells, miners, or DDoS bots remain unidentified.
• Siemens advisory (SSA-834709) targets SIMATIC IoT2050 Advanced Industrial OS versions prior to 4.3.4.1 with embedded Node-RED, urging updates to that version.

Inference

• Inference: Because different payloads and User-Agents are sent from the same IP, it is highly likely that shared, rented, or compromised scanning infrastructure is being abused rather than infrastructure dedicated to a single attacker.
• Inference: Files placed in /dev/shm disappear upon reboot, but webshells registered as flow definitions persist after reboot; therefore, the absence of files alone does not rule out a compromise.

Hypothesis

No additional hypotheses. Unconfirmed items are noted in "Unknowns and Limitations".

13. MITRE ATT&CK Mappings

ID	Technique	Confidence	Basis
T1190	Exploit Public-Facing Application	high	Observed attack requests sending POST /flows to unauthenticated Node-RED management APIs to deploy command execution nodes.
T1059.004	Unix Shell	high	Confirmed commands piping Base64 decode results to sh for downloading, permission changing, and background execution.
T1105	Ingress Tool Transfer	high	Confirmed requests fetching Linux binaries from external servers using wget or curl.
T1505.003	Web Shell	high	Observed webshell-type flows directly connecting HTTP In nodes to exec nodes to execute remote commands via URL parameters.

14. Unknowns and Limitations

• Although the canary environment returned successful responses, no individual victim cases where payloads successfully executed in production Node-RED environments have been publicly reported.
• The functionalities of unretrieved binaries, the identities of threat actors, and the existence of victim organizations remain unknown.
• The official scope of the CVE is Siemens SIMATIC IoT2050 Advanced (prior to 4.3.4.1) running Industrial OS with Node-RED. Whether this CVE number applies uniformly to other vendor products or standalone Node-RED environments requires verification with each vendor.

15. Impact on SOCs and Organizations

Organizations operating Node-RED or SIMATIC IoT2050 in manufacturing, infrastructure facilities, building automation, and other sectors must urgently inspect whether management interfaces are inadvertently exposed to the internet and ensure that adminAuth is properly configured. It is important to note that automated attack requests complete in a single POST, and establishing monitoring to detect suspicious requests to management APIs as well as the unauthorized addition of exec or HTTP In nodes within flows is critical.

16. Summary by Target

• SOC: Monitor for POST /flows occurrences, unauthorized additions of exec nodes, communications destined for payload servers, and hidden files in /dev/shm or /tmp.
• Administrators: Restrict management ports to internal closed networks, enable adminAuth, and apply Siemens product patches (v4.3.4.1 or later).
• Users: Report unexpected automation behaviors or flow modifications promptly to system administrators.