Attackers Are Hijacking Node-RED With One Web Request: A Checklist for Shops and Plants Running It on the Floor

Node-RED is a free, drag-and-drop tool for wiring machines, sensors and software together. It shows up in more places than most shop owners realize: on industrial gateways and edge PCs, on a Raspberry Pi someone set up to log a press or a kiln, on dashboards that track a print queue or a booth's lighting rig, and built into commercial gear such as Siemens' SIMATIC IoT2050. On Oct. 30, 2026, security firm VulnCheck caught attackers breaking into Node-RED installations that don't require a login, and SecurityWeek reported the attacks on Nov. 3.

The attack takes one web request. If your Node-RED editor can be reached from the internet and nobody turned on its admin login, an outsider can add their own program to it and have it run commands on the machine.

What's been reported

The bug. CVE-2026-58115 is rated 10 out of 10. In its advisory, Siemens says affected SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed "do not enforce authentication on the Node-RED HTTP interface," which "could allow an unauthenticated remote attacker to create malicious flows" and run code "with maximum privileges." Siemens fixed it in version 4.3.4.1.
What the attackers did. VulnCheck says the first attack sent a single request that added a small Node-RED flow, ran it automatically, and downloaded a Linux program from the attacker's server. By Nov. 1 it had logged 16 attempts from the same address, including some that left behind webshells, which let an attacker come back and run commands later.
Who is being hit. VulnCheck reads it as opportunistic mass scanning, not a targeted campaign: the same address was also trying old bugs in unrelated products. In SecurityWeek's words, attackers are "actively scanning for Node-RED instances without adminAuth and exploiting them automatically."
What isn't known. VulnCheck says it didn't analyze the downloaded program, so it doesn't know whether it's a miner, a botnet tool or something else. No business has been named as a victim, and no ransomware or data theft has been reported. The bug is in VulnCheck's own exploited list but was not in CISA's Known Exploited Vulnerabilities catalog as of this morning.

Why a shop, plant or exhibit house should care

Node-RED usually sits right next to the equipment it talks to. A hacked gateway on the shop floor can be used to watch or change what the machines are told to do, or as a foothold onto the rest of the network where your job files, estimating and accounting live. Even if the attackers only want free computing power, a box running their software is a box you can't trust.

It is also exactly the kind of system nobody owns. An integrator installed it with the machine, a technician set up a dashboard and forwarded a port so he could check it from home, or a trade show crew built something for a client and left it running. Node-RED's own documentation says it does not secure the editor by default; someone has to turn the login on.

Clear takeaway

Find every Node-RED install your business runs, make sure none of them can be reached from the internet, turn on the admin login, and look through the flows for anything you didn't build.

What to do this week

Make a list. Ask your machine vendors and integrators whether any gateway, edge PC, panel or IoT box they installed runs Node-RED. Check Raspberry Pis and spare PCs on the shop floor and in the warehouse, and ask anyone who builds booth or event controls.
Check what the internet can see. Node-RED's editor normally listens on port 1880. Look at your router or firewall for port-forwarding rules to 1880 or to any gateway, and close anything you don't need. Use a VPN for remote access instead.
Turn on the admin login. Node-RED's security guide shows how to enable adminAuth in the settings file with a username and a hashed password. Use a password you don't use anywhere else.
Update Siemens IoT2050 devices. If you have SIMATIC IoT2050 Advanced units with Node-RED, update to 4.3.4.1 or later. Siemens says that if you can't, uninstall Node-RED or harden it using the Node-RED guide.
Look for flows you didn't build. VulnCheck says to review deployed flows "for unexpected exec nodes or HTTP endpoints." An exec node runs shell commands, so any you don't recognize is a red flag. On Linux boxes, files in /dev/shm or /tmp with hidden names (such as .b, .s or .kworker) match what VulnCheck saw.
If you find something, rebuild. Disconnect the box from the network, export the flows you know are good, and reinstall from a clean image. Then change any passwords or keys that box stored, such as database, MQTT or cloud logins.
Separate it from the office network. Machines and the gateways that run them belong on their own network, not the one with your file server and accounting PCs.

How Brotherly Technology can help

Brotherly Technology works with production shops, manufacturers and exhibit builders on exactly this kind of equipment. We can find the Node-RED installs and other forgotten controllers on your network, check what the internet can reach, turn on logins, review the flows, and move machine traffic onto its own network. If an integrator set something up years ago and nobody has looked at it since, call us and we'll check it this week.