Unknown cybercriminals are exploiting a serious vulnerability in Node-RED, a programming tool used in industrial environments. Through this security flaw, they install Linux malware and plant backdoors that allow them to maintain access to compromised systems.
This has been revealed by research from VulnCheck. On October 30, the security firm intercepted an attack targeting CVE-2026-58115. This vulnerability has a maximum CVSS score of 10. Since then, researchers have recorded multiple attempts to exploit the vulnerability.
Node-RED is a Node.js-based programming environment that allows users to build automated workflows. The software is used in industrial control systems and building automation, among other applications. Siemens also uses Node-RED in its SIMATIC IoT2050, a gateway for industrial applications.
The vulnerability arises because affected devices do not require authentication to access the management interface. This allows attackers to remotely create workflows that execute commands on the underlying operating system.
Malware from RAM
VulnCheck intercepted an attack in which the attacker sent the entire exploit in a single HTTP request. The attacker combined two standard Node-RED components to automatically execute commands.
The malicious code was hidden behind multiple layers of encryption. An attempt was then made to download and execute a Linux bot from /dev/shm, a location that utilizes RAM, as a result, the malware leaves fewer traces on regular disk storage.
The researchers could not analyze the downloaded program. The filename `bot-linux-amd64` indicates malware targeting Linux systems with AMD64 processors, but its exact functionality is unknown.
In other attacks, the researchers discovered a method for gaining persistent access. In these attacks, the attackers created new HTTP endpoints within Node-RED. Through these endpoints, they can later execute system commands again.
These backdoors remain part of the Node-RED configuration and can therefore remain active even after a system restart. Simply removing the malware from RAM is then insufficient to block the attacker.
Between October 30 and November 1, VulnCheck also recorded attacks targeting other vulnerabilities, including those in Apache Solr, Gitea, and Joomla, originating from the same IP address. According to the researchers, this indicates large-scale, automated attacks rather than targeted actions against specific organizations.
VulnCheck advises organizations to check whether their Node-RED installations are accessible from the internet. In addition, organizations should install available updates and check existing workflows for suspicious commands and unknown HTTP endpoints.