Max-severity bug in widely used OT programming tool exploited to deliver Linux malware

Node-RED, a popular programming tool used in critical infrastructure, has been targeted by criminals exploiting a critical vulnerability. This flaw, assigned CVE-2026-58115 by Siemens, allows unauthenticated remote attackers to deploy malware that can execute system commands on affected devices. Node-RED, built on Node.js, is commonly used for workflow automation in industrial control systems and operational technology environments.

The vulnerability arises from insufficient authentication on the Node-RED HTTP interface, enabling unauthorized access to programming nodes that can execute system commands. Last Friday, VulnCheck researchers documented an attack that exploited this vulnerability. Two Node-RED built-in nodes, an inject node and an exec node, make this exploitation "trivial to weaponize."

The inject node fires a message either on a schedule or at startup, while the exec node can run shell commands. Once exploited, an attacker can create malicious flows without further interaction. Researchers tracked a single IP address, originating from Microsoft’s AS8075 network in Brazil, that repeatedly targeted this Node-RED vulnerability between October 30 and November 1.

This activity included exploiting a seven-year-old Apache Solr flaw and 125 hits against eight different CVEs across their wider canary network. The attack suggests opportunistic mass scanning rather than a targeted assault. After infecting a vulnerable Node-RED instance, attackers likely pulled the implant from a separate server.

As such exploits become more common, it is crucial for organizations using Node-RED, especially in OT environments, to check their systems for external reachability, apply updates, and implement detection measures to mitigate the risk of exploitation.