Attackers are sending malicious flows to exposed Node-RED interfaces, according to VulnCheck research published November 2. The company recorded 16 events from one source address between October 30 and November 1, targeting interfaces that allowed deployment without authentication.
The requests went beyond looking for an open service. They attempted to install flows that would download and execute Linux payloads. Other requests created command-access endpoints inside the flow configuration. VulnCheck did not obtain the downloaded binaries or scripts, so their eventual capabilities remain unknown.
What the observations establish
The evidence comes from a canary: a monitored system that replied as a vulnerable instance would. It establishes exploitation attempts against the interface, rather than confirmed compromise of a factory or utility. A cloud-hosted source address also does not identify the attacker.
The associated vulnerability, CVE-2026-58115, has a specific industrial product scope. Siemens advisory SSA-834709 covers SIMATIC IoT2050 Advanced devices, model 6ES7647-0BA00-1YA2, before V4.3.4.1 when running Industrial OS with Node-RED installed. Missing authentication can let a remote attacker deploy flows and execute commands with maximum privileges. That is not a finding that every product incorporating Node-RED is vulnerable.
Check exposure and access controls
Siemens directs affected customers to V4.3.4.1 or later and lists removing or hardening Node-RED as mitigations. It also recommends protecting network access to the devices.
Node-RED’s own security guide warns that its default editor configuration permits anyone who can reach it to deploy changes and is suitable only on a trusted network. The guide documents adminAuth for the editor and administrative API, HTTPS, and separate protection for HTTP-node routes. Securing one interface should not be mistaken for securing every application endpoint.
VulnCheck also recommends reviewing deployed flows for unexpected command-execution nodes or HTTP endpoints.
Sources: VulnCheck exploitation research; Siemens SSA-834709; Securing Node-RED.
Image: AI-generated editorial illustration created for DaySec, not a photograph of the incident.
