Max-severity bug in widely used OT programming tool exploited to deliver Linux malware
CVE-2026-58115, a perfect 10.0 CVSS vulnerability in Node-RED, lacks authentication enforcement on the HTTP interface, allowing unauthenticated attackers to deploy malicious flows. Node-RED, used widely in industrial control systems (ICS) and operational technology (OT) environments including Siemens devices, has two built-in nodes—inject and exec—that make the flaw trivial to weaponize. Researchers documented active exploitation beginning October 30, 2026, where attackers used the vulnerability to execute arbitrary system commands.
Key points
- CVE-2026-58115 in Node-RED: perfect 10.0 CVSS score
- Unauthenticated attackers can create malicious flows via HTTP
- Affects critical infrastructure and industrial control systems
- Active exploitation documented; trivial to weaponize via inject/exec nodes
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The Register did the reporting; read the original for the full story.
Read the full story at The Register
