Critical Node-RED Flaw Exploited to Deploy Linux Malware in OT Environments
A maximum-severity vulnerability in the widely used Node-RED programming tool is being actively exploited to deliver Linux malware, posing a significant threat to operational technology and industrial control systems.
Unknown threat actors are actively exploiting a critical vulnerability, tracked as CVE-2026-58115, in Node-RED, a popular flow-based programming tool extensively utilized in operational technology (OT) and industrial control systems (ICS) environments. The vulnerability, which carries a perfect CVSS score of 10/10, allows unauthenticated attackers to execute arbitrary system commands by manipulating Node-RED's programming nodes. This enables the deployment of malicious flows that can download and run Linux malware on affected devices.
Node-RED, built on Node.js, is frequently integrated into commercial products, including Siemens SIMATIC IoT2050 devices. The vulnerability stems from a lack of authentication enforcement on Node-RED's HTTP interface, granting unauthenticated remote attackers the ability to create and deploy malicious workflows. Researchers at VulnVulnCheck observed exploitation attempts on October 30, 2026, noting that two built-in Node-RED nodes—the inject node and the exec node—make weaponizing this flaw particularly straightforward. By chaining these nodes, an attacker can execute a command as soon as a malicious flow is deployed, requiring no further user interaction.
The exploitation of this vulnerability occurs amid a broader trend of attackers increasingly targeting internet-exposed OT and ICS devices, aiming to cause physical world disruptions. Recent incidents, such as attacks on refrigeration controllers in Europe and water systems across the US, highlight the growing risk. The observed exploitation activity originated from a single IP address (4.201.105[.]116) in Brazil, which sent the complete exploit, including the malicious flow and a dropper, in a single POST request.
While the exact nature of the deployed malware remains unknown as researchers did not retrieve a binary, the filename 'bot-linux-amd64' suggests it targets Linux systems running on AMD64 processors. This implies the malware operator may possess different builds for various architectures. The attackers' activity, observed between October 30 and November 1, involved 16 attempts against this specific Node-RED vulnerability and 125 hits across eight different CVEs on VulnVulnCheck's canary network, indicating opportunistic mass scanning rather than a highly targeted campaign.
Further analysis revealed that one of the exploitation attempts pointed to a separate server (85.215.73[.]250) for the payload, suggesting a scan-and-infect setup where vulnerable instances are identified and exploited, and the malware implant is then downloaded from a dedicated server. The mix of exploited vulnerabilities, including an older Apache Solr flaw (CVE-2019-17558), across unrelated products reinforces the assessment of opportunistic scanning.
In response to the threat, VulnVulnCheck has added CVE-2026-58115 to its Known Exploited Vulnerabilities (KEV) catalog. However, as of press time, it had not yet been listed on the US Cybersecurity and Infrastructure Security Agency's (CISA) KEV catalog. Organizations using Node-RED, especially those with internet-facing instances or within OT environments, are strongly advised to verify their exposure, apply available updates, and implement detection mechanisms to mitigate the risk of exploitation.
The exploitation of Node-RED highlights the persistent threat to OT and ICS environments, where the convergence of IT and OT systems creates new attack vectors. The ease with which this critical vulnerability can be weaponized underscores the need for continuous monitoring, robust security practices, and prompt patching of all internet-facing systems, particularly those controlling critical infrastructure.