---
title: Hunt: Node-RED exploitation (CVE-2026-58115) shows up as an unauthenticated POST /flows, an inject-to-exec flow, /dev/shm/.b or /tmp/.kworker, and http-in webshell flows | ctxsec
url: https://ctxsec.com/items/hunt-node-red-cve-2026-58115-exec-flows-dev-shm-webshell
description: "VulnCheck published the full request chain and indicators from in-the-wild exploitation of the Node-RED flaw in Siemens IoT2050 devices. Exploitation takes one unauthenticated POST /flows that deploys a flow running a base64-encoded dropper, or an http-in endpoint wired to exec for a persistent webshell. Use the indicators below on Node-RED hosts and network logs."
status: "official (VulnCheck canary data and IoCs, Nov 2)"
published: 2026-11-03
---

> VulnCheck published the full request chain and indicators from in-the-wild exploitation of the Node-RED flaw in Siemens IoT2050 devices. Exploitation takes one unauthenticated POST /flows that deploys a flow running a base64-encoded dropper, or an http-in endpoint wired to exec for a persistent webshell. Use the indicators below on Node-RED hosts and network logs.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-node-red-cve-2026-58115-exec-flows-dev-shm-webshell.md)

official (VulnCheck canary data and IoCs, Nov 2)

2026-11-03

### Hunt: Node-RED exploitation (CVE-2026-58115) shows up as an unauthenticated POST /flows, an inject-to-exec flow, /dev/shm/.b or /tmp/.kworker, and http-in webshell flows

- **Web/proxy logs:** `POST /flows` to Node-RED (default port 1880) from outside your management network, especially with curl, python-requests or Python-urllib user agents. A 200 response with a new `rev` hash means the flow was accepted.
- **Flow contents:** an `inject` node with `once: true` wired to an `exec` node whose command is `echo <base64> | base64 -d | sh`; or an `http in` node (e.g. `/cmd` or a random path) wired through a function node to an `exec` node with `addpay` enabled. Diff your current `flows.json` against a known-good copy.
- **Host artifacts:** `/dev/shm/.b`, `/tmp/.s`, `/tmp/.kworker`; processes started via `setsid` or `nohup` as children of the Node-RED process; `wget`/`curl` spawned by node.
- **Network IoCs (VulnCheck):** source 4.201.105[.]116; payload servers 85.215.73[.]250:8080 (`/bot-linux-amd64`, `/wget.sh`) and 45.194.90[.]57:38472 (`/.sys_update`).

A `/dev/shm` implant disappears on reboot, but webshell flows persist in `flows.json`, so rebooting is not cleanup. Remove the rogue flows, enable `adminAuth`, then rotate any credentials stored in Node-RED's credential file.

Sources: [VulnCheck: Exploitation Targeting Node-RED (IoCs and dropper analysis)](https://www.vulncheck.com/blog/exploitation-targeting-node-red) · [Siemens ProductCERT: SSA-834709](https://cert-portal.siemens.com/productcert/html/ssa-834709.html)