FUXA v1.3.2-2809 faces a CRITICAL /nodered auth bypass (CVE-2026-42922) allowing unauthenticated code execution. No patch — restrict access & monitor endpoints. Details: https://radar.offseq.com/threat/a-authorization-bypass-vulnerability-exists-in-the-nodered-functionality-of-fuxa-versions-cve-2...
A authorization bypass vulnerability exists in the /nodered functionality of FUX
CVE-2026-42922 describes an authorization bypass vulnerability in the /nodered functionality of FUXA version 1.3.2-2809. An attacker can exploit this by making an unauthenticated HTTP request, bypassing authorization controls, and triggerin
radar.offseq.com
October 29, 2026 at 7:30 AM
FUXA v1.3.2-2809 faces a CRITICAL /nodered auth bypass (CVE-2026-42922) allowing unauthenticated code execution. No patch — restrict access & monitor endpoints. Details: https://radar.offseq.com/threat/a-authorization-bypass-vulnerability-exists-in-the-nodered-functionality-of-fuxa-versions-cve-2...
Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)
Attackers are exploiting an authentication flaw in Node-RED, CVE-2026-58115, to install a Linux bot and backdoors on unprotec... https://threatintel.cc/2026/11/03/attackers-exploit-critical-nodered-flaw.html
Attackers are exploiting an authentication flaw in Node-RED, CVE-2026-58115, to install a Linux bot and backdoors on unprotec... https://threatintel.cc/2026/11/03/attackers-exploit-critical-nodered-flaw.html
November 3, 2026 at 1:18 PM
Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)
Attackers are exploiting an authentication flaw in Node-RED, CVE-2026-58115, to install a Linux bot and backdoors on unprotec... https://threatintel.cc/2026/11/03/attackers-exploit-critical-nodered-flaw.html
Attackers are exploiting an authentication flaw in Node-RED, CVE-2026-58115, to install a Linux bot and backdoors on unprotec... https://threatintel.cc/2026/11/03/attackers-exploit-critical-nodered-flaw.html
Attackers are actively exploiting a maximum-severity authentication flaw in Node-RED on Siemens SIMATIC IoT2050 Advanced devices, tracked as CVE-2026-58115.
https://en.hacks.gr/keno-asfaleias-se-syskeyles-tis-siemens-chrisimopoieitai-se-epitheseis/
#Siemens #NodeRED #Vulnerability
https://en.hacks.gr/keno-asfaleias-se-syskeyles-tis-siemens-chrisimopoieitai-se-epitheseis/
#Siemens #NodeRED #Vulnerability
November 3, 2026 at 5:43 AM
Attackers are actively exploiting a maximum-severity authentication flaw in Node-RED on Siemens SIMATIC IoT2050 Advanced devices, tracked as CVE-2026-58115.
https://en.hacks.gr/keno-asfaleias-se-syskeyles-tis-siemens-chrisimopoieitai-se-epitheseis/
#Siemens #NodeRED #Vulnerability
https://en.hacks.gr/keno-asfaleias-se-syskeyles-tis-siemens-chrisimopoieitai-se-epitheseis/
#Siemens #NodeRED #Vulnerability
El Reg: Max-severity bug in widely used OT programming tool exploited to deliver Linux malware ¹
Me: *reads* node red?! 10/10 severity? Fuck I have like 20 instances of that deployed. Panic stations!
Reads further: Siemens ships an “Industrial IoT” device with embedded nodered and no password […]
Me: *reads* node red?! 10/10 severity? Fuck I have like 20 instances of that deployed. Panic stations!
Reads further: Siemens ships an “Industrial IoT” device with embedded nodered and no password […]
Original post on aus.social
aus.social
November 4, 2026 at 12:09 AM
El Reg: Max-severity bug in widely used OT programming tool exploited to deliver Linux malware ¹
Me: *reads* node red?! 10/10 severity? Fuck I have like 20 instances of that deployed. Panic stations!
Reads further: Siemens ships an “Industrial IoT” device with embedded nodered and no password […]
Me: *reads* node red?! 10/10 severity? Fuck I have like 20 instances of that deployed. Panic stations!
Reads further: Siemens ships an “Industrial IoT” device with embedded nodered and no password […]
🚨 CVE-2026-42922 — CVSS 9.8 CRITICAL
A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809)....
🔎 https://stemshop.top/cve/CVE-2026-42922
#CVE #CyberSecurity #InfoSec
A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809)....
🔎 https://stemshop.top/cve/CVE-2026-42922
#CVE #CyberSecurity #InfoSec
October 29, 2026 at 6:07 AM
🚨 CVE-2026-42922 — CVSS 9.8 CRITICAL
A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809)....
🔎 https://stemshop.top/cve/CVE-2026-42922
#CVE #CyberSecurity #InfoSec
A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809)....
🔎 https://stemshop.top/cve/CVE-2026-42922
#CVE #CyberSecurity #InfoSec
boneIO Black's open Node-RED hands LAN attackers code exec, then passwordless sudo gives root. https://intel.threadlinqs.com/threat/TL-2026-4460?utm_source=bluesky #ThreatIntel #CVE_2026_77052 #CVE_2026_77053 #NodeRED
October 26, 2026 at 3:57 PM
boneIO Black's open Node-RED hands LAN attackers code exec, then passwordless sudo gives root. https://intel.threadlinqs.com/threat/TL-2026-4460?utm_source=bluesky #ThreatIntel #CVE_2026_77052 #CVE_2026_77053 #NodeRED
CVE-2026-40063 - FUXA Information Disclosure Vulnerability
CVE ID : CVE-2026-40063
Published : Oct. 29, 2026, 2:59 a.m. | 30 minutes ago
Description : A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809...
CVE ID : CVE-2026-40063
Published : Oct. 29, 2026, 2:59 a.m. | 30 minutes ago
Description : A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809...
CVE-2026-40063 - FUXA Information Disclosure Vulnerability
A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to an information leak. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
cvefeed.io
October 29, 2026 at 4:05 AM
CVE-2026-40063 - FUXA Information Disclosure Vulnerability
CVE ID : CVE-2026-40063
Published : Oct. 29, 2026, 2:59 a.m. | 30 minutes ago
Description : A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809...
CVE ID : CVE-2026-40063
Published : Oct. 29, 2026, 2:59 a.m. | 30 minutes ago
Description : A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809...
CVE-2026-42922 - FUXA Authorization Bypass and Remote Code Execution
CVE ID : CVE-2026-42922
Published : Oct. 29, 2026, 2:59 a.m. | 30 minutes ago
Description : A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A ...
CVE ID : CVE-2026-42922
Published : Oct. 29, 2026, 2:59 a.m. | 30 minutes ago
Description : A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A ...
CVE-2026-42922 - FUXA Authorization Bypass and Remote Code Execution
A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
cvefeed.io
October 29, 2026 at 3:57 AM
CVE-2026-42922 - FUXA Authorization Bypass and Remote Code Execution
CVE ID : CVE-2026-42922
Published : Oct. 29, 2026, 2:59 a.m. | 30 minutes ago
Description : A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A ...
CVE ID : CVE-2026-42922
Published : Oct. 29, 2026, 2:59 a.m. | 30 minutes ago
Description : A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A ...
🚨 EUVD-2026-112581
📊 9.8/10
🏢 frangoteam
📝 A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112581
#cybersecurity #infosec #cve #euvd
📊 9.8/10
🏢 frangoteam
📝 A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112581
#cybersecurity #infosec #cve #euvd
October 29, 2026 at 4:02 AM
🚨 EUVD-2026-112581
📊 9.8/10
🏢 frangoteam
📝 A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112581
#cybersecurity #infosec #cve #euvd
📊 9.8/10
🏢 frangoteam
📝 A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112581
#cybersecurity #infosec #cve #euvd
🚨 EUVD-2026-112582
📊 5.3/10
🏢 frangoteam
📝 A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP r...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112582
#cybersecurity #infosec #cve #euvd
📊 5.3/10
🏢 frangoteam
📝 A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP r...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112582
#cybersecurity #infosec #cve #euvd
October 29, 2026 at 4:02 AM
🚨 EUVD-2026-112582
📊 5.3/10
🏢 frangoteam
📝 A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP r...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112582
#cybersecurity #infosec #cve #euvd
📊 5.3/10
🏢 frangoteam
📝 A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP r...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112582
#cybersecurity #infosec #cve #euvd
📢 Exploitation active de CVE-2026-58115 dans Node-RED pour déployer un malware Linux sur des équipements OT
The Register, publié le 2 novembre 2026. L'information est basée sur un advisory publié par VulnCheck (chercheur Patrick…
🟢 vérification factuelle haute
#NodeRED #LinuxMalware #Cyberveille
The Register, publié le 2 novembre 2026. L'information est basée sur un advisory publié par VulnCheck (chercheur Patrick…
🟢 vérification factuelle haute
#NodeRED #LinuxMalware #Cyberveille
Exploitation active de CVE-2026-58115 dans Node-RED pour déployer un malware Linux sur des équipements OT
The Register, publié le 2 novembre 2026. L'information est basée sur un advisory publié par VulnCheck (chercheur Patrick Garrity) le même jour, faisant suite à la détection d'une exploitation active observée à partir du 30 octobre 2026.
cyberveille.ch
November 3, 2026 at 4:30 PM
📢 Exploitation active de CVE-2026-58115 dans Node-RED pour déployer un malware Linux sur des équipements OT
The Register, publié le 2 novembre 2026. L'information est basée sur un advisory publié par VulnCheck (chercheur Patrick…
🟢 vérification factuelle haute
#NodeRED #LinuxMalware #Cyberveille
The Register, publié le 2 novembre 2026. L'information est basée sur un advisory publié par VulnCheck (chercheur Patrick…
🟢 vérification factuelle haute
#NodeRED #LinuxMalware #Cyberveille
A critical 10.0 CVSS Node-RED RCE vulnerability (CVE-2026-58115) is exploited in the wild to deploy Linux bot malware. Secure your exposed instances now.
#NodeRED #RCE #CVE202658115 #Siemens #IoT #Cybersecurity #Vulnerability #InfoSec
#NodeRED #RCE #CVE202658115 #Siemens #IoT #Cybersecurity #Vulnerability #InfoSec
Node-RED Remote Code Execution Flaw CVE-2026-58115 with 10.0 CVSS Exploited in the Wild
TL;DR Security firm VulnCheck warned on November 2, 2026, that threat actors are actively exploiting a critical Node-RED RCE flaw in the wild. Tracked as CVE-2026-58115 with a maximum 10.0 CVSS score, the missing-authentication vulnerability lets unauthenticated remote attackers execute arbitrary system commands on exposed hosts. Attackers deploy malicious flows to drop Linux bot implants and install persistent webshells across operational technology networks.
securityonline.info
November 3, 2026 at 12:05 AM
A critical 10.0 CVSS Node-RED RCE vulnerability (CVE-2026-58115) is exploited in the wild to deploy Linux bot malware. Secure your exposed instances now.
#NodeRED #RCE #CVE202658115 #Siemens #IoT #Cybersecurity #Vulnerability #InfoSec
#NodeRED #RCE #CVE202658115 #Siemens #IoT #Cybersecurity #Vulnerability #InfoSec
My home light automations stopped working 23:00 today: guess why? #nodered #homeassistant
October 25, 2026 at 10:53 PM
My home light automations stopped working 23:00 today: guess why? #nodered #homeassistant
🚨 EUVD-2026-109947
📊 8.7/10
🏢 boneIO
📝 boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploy...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109947
#cybersecurity #infosec #cve #euvd
📊 8.7/10
🏢 boneIO
📝 boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploy...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109947
#cybersecurity #infosec #cve #euvd
October 26, 2026 at 4:04 PM
🚨 EUVD-2026-109947
📊 8.7/10
🏢 boneIO
📝 boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploy...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109947
#cybersecurity #infosec #cve #euvd
📊 8.7/10
🏢 boneIO
📝 boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploy...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109947
#cybersecurity #infosec #cve #euvd
Node RED bleibt flexibel und vielseitig Node RED verbindet einfache Bedienung mit echter Programmierfreiheit #NodeRED
October 24, 2026 at 5:04 AM
Node RED bleibt flexibel und vielseitig Node RED verbindet einfache Bedienung mit echter Programmierfreiheit #NodeRED
Node-RED macht es sehr einfach, Abläufe visuell zusammenzubauen und eigene Logik mit JavaScript in Function-Nodes zu ergänzen. Solange ein Flow funktioniert, ist das angenehm unkompliziert. #debuggen #NodeRED
https://bit.ly/4iEp6CY
https://bit.ly/4iEp6CY
Node-RED debuggen: JavaScript-Fehler, Logs und Speicherprobleme finden
Node-RED macht es sehr einfach, Abläufe visuell zusammenzubauen und eigene Logik mit JavaScript in Function-Nodes zu ergänzen. Solange ein Flow funktioniert,
bit.ly
October 24, 2026 at 3:49 PM
Node-RED macht es sehr einfach, Abläufe visuell zusammenzubauen und eigene Logik mit JavaScript in Function-Nodes zu ergänzen. Solange ein Flow funktioniert, ist das angenehm unkompliziert. #debuggen #NodeRED
https://bit.ly/4iEp6CY
https://bit.ly/4iEp6CY
yeah I am familiar with NodeRED, regrettably.
October 14, 2026 at 3:18 AM
yeah I am familiar with NodeRED, regrettably.
An LLM audits a production flows.json and finds 16 crimes. Claude cleans up messy MQTT. Real-time OEE runs on a tea bag line.
Node-RED Con 2026: 12 talks from people running Node-RED in production. Free and online, Nov 3.
nrcon.nodered.org
#nodered #industrialautomation #flowfuse
Node-RED Con 2026: 12 talks from people running Node-RED in production. Free and online, Nov 3.
nrcon.nodered.org
#nodered #industrialautomation #flowfuse
Node-RED Con 2026 - November 3, 2026
Node-RED Con brings the community together to share how Node-RED is being used to solve real problems — from factory floors to edge deployments and AI integration.
nrcon.nodered.org
October 16, 2026 at 4:27 PM
An LLM audits a production flows.json and finds 16 crimes. Claude cleans up messy MQTT. Real-time OEE runs on a tea bag line.
Node-RED Con 2026: 12 talks from people running Node-RED in production. Free and online, Nov 3.
nrcon.nodered.org
#nodered #industrialautomation #flowfuse
Node-RED Con 2026: 12 talks from people running Node-RED in production. Free and online, Nov 3.
nrcon.nodered.org
#nodered #industrialautomation #flowfuse
L'ensemble est envoyé par l'ESP32 en wifi dans un serveur MQTT sous Fedora 44, mis en mémoire par InfluxDB, consultable visuellement par Grafana, et je peux router les flux vers d'autres standards de communication avec NodeRed.
October 14, 2026 at 8:19 PM
L'ensemble est envoyé par l'ESP32 en wifi dans un serveur MQTT sous Fedora 44, mis en mémoire par InfluxDB, consultable visuellement par Grafana, et je peux router les flux vers d'autres standards de communication avec NodeRed.
Node RED Ende 2026 noch zeitgemaess Node RED oder Home Assistant: Warum flexible Automationen besser passen. #NodeRED #SmartHome
October 12, 2026 at 4:05 PM
Node RED Ende 2026 noch zeitgemaess Node RED oder Home Assistant: Warum flexible Automationen besser passen. #NodeRED #SmartHome
I made a thing. It's a sort of #nodered for microcontrollers. It uses #micropython as its base language. It's very raw at the moment. Comments welcome
https://docs.thingstudio.net/
https://github.com/mkarliner/ThingStudio
https://docs.thingstudio.net/
https://github.com/mkarliner/ThingStudio
Thingstudio
Node-and-wire visual programming for microcontrollers.
docs.thingstudio.net
October 11, 2026 at 10:46 AM
I made a thing. It's a sort of #nodered for microcontrollers. It uses #micropython as its base language. It's very raw at the moment. Comments welcome
https://docs.thingstudio.net/
https://github.com/mkarliner/ThingStudio
https://docs.thingstudio.net/
https://github.com/mkarliner/ThingStudio
Ever try growing your own ? I was crap at keeping plants alive until I used a computer hackaday.io/project/1881...
Raspberry Pi4 - Basic watering system for balcony
Using NodeRED to set up basic automated watering on my plants on the balcony. As simple as possible outdoors (i.e. few wires), so I'm not powering the Rhaspberry Pi 4 via typical USB, but using a POE ...
hackaday.io
September 23, 2026 at 4:14 PM
Ever try growing your own ? I was crap at keeping plants alive until I used a computer hackaday.io/project/1881...
Registration for Node-RED Con 2026 is now open.
The programme is set and it's a strong one. November 3rd, free and online.
events.zoom.us/ev/Ag_xPefs5...
#NodeRED #NRCon2026
The programme is set and it's a strong one. November 3rd, free and online.
events.zoom.us/ev/Ag_xPefs5...
#NodeRED #NRCon2026
September 22, 2026 at 10:29 AM
Registration for Node-RED Con 2026 is now open.
The programme is set and it's a strong one. November 3rd, free and online.
events.zoom.us/ev/Ag_xPefs5...
#NodeRED #NRCon2026
The programme is set and it's a strong one. November 3rd, free and online.
events.zoom.us/ev/Ag_xPefs5...
#NodeRED #NRCon2026
#nodered zerschossen - #sprachsteuerung für #homeassistant
Wer zu lange keine Updates macht, muss manchmal von vorne anfangen :-/
https://www.andreas-edler.de/blog/2026/09/node-red-zerschossen-sprachsteuerung-fuer-home-assistant/
#smarthome #amazonalexa
Wer zu lange keine Updates macht, muss manchmal von vorne anfangen :-/
https://www.andreas-edler.de/blog/2026/09/node-red-zerschossen-sprachsteuerung-fuer-home-assistant/
#smarthome #amazonalexa
September 20, 2026 at 11:42 AM
#nodered zerschossen - #sprachsteuerung für #homeassistant
Wer zu lange keine Updates macht, muss manchmal von vorne anfangen :-/
https://www.andreas-edler.de/blog/2026/09/node-red-zerschossen-sprachsteuerung-fuer-home-assistant/
#smarthome #amazonalexa
Wer zu lange keine Updates macht, muss manchmal von vorne anfangen :-/
https://www.andreas-edler.de/blog/2026/09/node-red-zerschossen-sprachsteuerung-fuer-home-assistant/
#smarthome #amazonalexa
#NodeRED zerschossen - #Sprachsteuerung für #HomeAssistant
Wer zu lange keine Updates macht, muss manchmal von vorne anfangen :-/
www.andreas-edler.de/blog/2026/09...
#Smarthome #AmazonAlexa
Wer zu lange keine Updates macht, muss manchmal von vorne anfangen :-/
www.andreas-edler.de/blog/2026/09...
#Smarthome #AmazonAlexa
Node-RED zerschossen – Sprachsteuerung für Home Assistant
Ich habe im Haus ein paar sog. „smarte“ Geräte. Viele Steckdosen verschiedenster Hersteller, Schalter, Aktoren, Sensoren – alles zusammengestückelt. Homematic, Philips Hue, Shelly, Innr, NoName-Zigbee...
www.andreas-edler.de
September 20, 2026 at 11:43 AM
#NodeRED zerschossen - #Sprachsteuerung für #HomeAssistant
Wer zu lange keine Updates macht, muss manchmal von vorne anfangen :-/
www.andreas-edler.de/blog/2026/09...
#Smarthome #AmazonAlexa
Wer zu lange keine Updates macht, muss manchmal von vorne anfangen :-/
www.andreas-edler.de/blog/2026/09...
#Smarthome #AmazonAlexa