--- title: Max-severity bug in widely used OT programming tool... description: Attackers are exploiting a maximum-severity Node-RED vulnerability, CVE-2026-58115, to deploy a flow that downloads and runs a Linux bot. Affected Siemens... canonical: https://daily.dev/posts/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware-78kx4k4ei twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Max-severity bug in widely used OT programming tool exploited to deliver Linux malware | daily.dev og:description: Attackers are exploiting a maximum-severity Node-RED vulnerability, CVE-2026-58115, to deploy a flow that downloads and runs a Linux bot. Affected Siemens... og:url: https://daily.dev/posts/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware-78kx4k4ei og:image: https://api.daily.dev/og/posts/78kx4k4EI.png og:image:alt: Max-severity bug in widely used OT programming tool exploited to deliver Linux malware og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Max-severity bug in widely used OT programming tool exploited to deliver Linux malware **[The Register](https://daily.dev/sources/theregister)** · 4 min read · 0 upvotes · 0 comments ## Summary Attackers are exploiting a maximum-severity Node-RED vulnerability, CVE-2026-58115, to deploy a flow that downloads and runs a Linux bot. Affected Siemens devices don't enforce authentication on the Node-RED HTTP interface, letting unauthenticated attackers execute system commands. VulnCheck researcher Patrick Garrity says an inject node and an exec node make the bug trivial to weaponize, needing no further interaction once deployed. A single IP sent the complete exploit and dropper in one POST /flows request, and the researchers saw it target the same Node-RED vulnerability 16 times between October 30 and November 1. Across the wider canary network, 125 hits were logged against eight different CVEs, which Garrity said suggests opportunistic mass scanning rather than a targeted attack. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-58115 and why does it have a perfect CVSS score of 10? CVE-2026-58115 is a maximum-severity vulnerability affecting Node-RED on devices like the Siemens SIMATIC IoT2050, where the Node-RED HTTP interface does not enforce authentication. This lets unauthenticated remote attackers create malicious flows that execute system commands on the device, earning the flaw a perfect 10-out-of-10 CVSS rating. _Teams running Node-RED in OT environments can track emerging exploit activity like this on daily.dev._ ### How are attackers exploiting the Node-RED authentication bypass vulnerability? Attackers wire together two built-in Node-RED nodes: an inject node, which fires a message on a schedule or at startup, and an exec node, which runs shell commands. Connecting them lets a malicious flow execute a command immediately on deployment with no further interaction, making the exploit trivial to weaponize and deliver malware named bot-linux-amd64. _Developers securing automation pipelines can follow attack techniques like this on daily.dev._ ### Is the Node-RED CVE-2026-58115 exploit a targeted attack or mass scanning? It appears to be opportunistic mass scanning rather than a targeted attack. The same attacking IP address, geolocated to Brazil, hit the Node-RED flaw 16 times between October 30 and November 1, 2026, and logged 125 hits against eight different CVEs across unrelated products including Camunda, Gitea, MLflow, Traefik, and Joomla. _Security teams triaging scan traffic across their stack can monitor incidents like this on daily.dev._ ## Similar posts on daily.dev - [Max severity Flowise RCE vulnerability now exploited in attacks](https://daily.dev/posts/max-severity-flowise-rce-vulnerability-now-exploited-in-attacks-nem8jshgt) · BleepingComputer · 0 upvotes · 0 comments - [CISA says n8n critical bug exploited in real-world attacks](https://daily.dev/posts/cisa-says-n8n-critical-bug-exploited-in-real-world-attacks-cotowalwz) · The Register · 0 upvotes · 0 comments - [Critical n8n Flaw \(CVSS 9.9\) Enables Arbitrary Code Execution Across Thousands of Instances](https://daily.dev/posts/critical-n8n-flaw-cvss-9-9-enables-arbitrary-code-execution-across-thousands-of-instances-0f5bk1u6r) · The Hacker News · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware-78kx4k4ei) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Max-severity bug in widely used OT programming tool exploited to deliver Linux malware","url":"https://daily.dev/posts/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware-78kx4k4ei","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware-78kx4k4ei"},"datePublished":"2026-11-02T22:57:12.991Z","dateModified":"2026-11-02T22:57:44.595Z","description":"Attackers are exploiting a maximum-severity Node-RED vulnerability, CVE-2026-58115, to deploy a flow that downloads and runs a Linux bot. Affected Siemens...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9d97bc1e119e87f8a673a7542e650a03?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9d97bc1e119e87f8a673a7542e650a03?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware-78kx4k4ei","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Max-severity bug in widely used OT programming tool exploited to deliver Linux malware"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware-78kx4k4ei#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-58115 and why does it have a perfect CVSS score of 10?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-58115 is a maximum-severity vulnerability affecting Node-RED on devices like the Siemens SIMATIC IoT2050, where the Node-RED HTTP interface does not enforce authentication. This lets unauthenticated remote attackers create malicious flows that execute system commands on the device, earning the flaw a perfect 10-out-of-10 CVSS rating. Teams running Node-RED in OT environments can track emerging exploit activity like this on daily.dev."}},{"@type":"Question","name":"How are attackers exploiting the Node-RED authentication bypass vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Attackers wire together two built-in Node-RED nodes: an inject node, which fires a message on a schedule or at startup, and an exec node, which runs shell commands. Connecting them lets a malicious flow execute a command immediately on deployment with no further interaction, making the exploit trivial to weaponize and deliver malware named bot-linux-amd64. Developers securing automation pipelines can follow attack techniques like this on daily.dev."}},{"@type":"Question","name":"Is the Node-RED CVE-2026-58115 exploit a targeted attack or mass scanning?","acceptedAnswer":{"@type":"Answer","text":"It appears to be opportunistic mass scanning rather than a targeted attack. The same attacking IP address, geolocated to Brazil, hit the Node-RED flaw 16 times between October 30 and November 1, 2026, and logged 125 hits against eight different CVEs across unrelated products including Camunda, Gitea, MLflow, Traefik, and Joomla. Security teams triaging scan traffic across their stack can monitor incidents like this on daily.dev."}}]} ```