# CVE-2026-58115: Max-severity Node-RED vulnerability exploited to deploy Linux malware

> **Key takeaway:** Unauthenticated attackers are exploiting a critical Node-RED flaw to execute shell commands and install AMD64 Linux bots on industrial control systems.

**Published:** 2026-11-02T22:55:17+00:00 
**Source:** The Register 
**Category:** kernel-os 
**Canonical URL:** https://fosswire.org/news/cve-2026-58115-max-severity-node-red-vulnerability-exploited.html 

## Summary
Security researchers have identified active exploitation of CVE-2026-58115, a maximum-severity vulnerability in the Node-RED flow-based programming tool. The flaw carries a CVSS score of 10.0 and allows unauthenticated remote attackers to gain control over devices running the software. This is particularly critical for operational technology (OT) and industrial control systems (ICS) where Node-RED is used for workflow automation.

Attackers are utilizing the vulnerability to deploy malicious flows that automatically download and execute Linux-based malware. Specifically, the exploits target the lack of authentication on the Node-RED HTTP interface in certain commercial implementations, such as the Siemens SIMATIC IoT2050. The observed malware, identified as 'bot-linux-amd64', indicates a focus on Linux systems running on AMD64 architectures.

## Technical breakdown of the CVE-2026-58115 exploit
- **Attack Vector:** Unauthenticated remote access via the Node-RED HTTP interface, which fails to enforce authentication on certain industrial hardware implementations.
- **Weaponization Method:** Attackers leverage the built-in 'inject' node to trigger messages and the 'exec' node to run arbitrary shell commands, allowing for immediate execution upon flow deployment.
- **Payload Delivery:** The exploit is delivered via a single 'POST /flows' request that contains the complete malicious flow and the dropper script in one transaction.
- **Targeted Architecture:** The identified malware filename, 'bot-linux-amd64', confirms the payload is designed for Linux environments running on AMD64 processors.
- **Exploitation Pattern:** Researchers observed opportunistic mass scanning from a single Brazilian IP address, targeting multiple unrelated vulnerabilities including an older Apache Solr flaw (CVE-2019-17558).

## Why it matters
This vulnerability poses a significant risk to critical infrastructure and industrial environments that rely on Node-RED for automation. System administrators must ensure that Node-RED interfaces are not reachable from the public internet and should prioritize applying security updates to all OT-integrated software components.