Attackers are taking over Node-RED installations that run without a login, and Siemens has widened its warning for the SIMATIC IoT2050 gateway accordingly. On 2 November 2026, VulnCheck reported that one of its decoy systems was hit on 30 October through CVE-2026-58115, a flaw rated 10.0 out of 10. Two days later, on 4 November, Siemens updated its advisory to cover all four IoT2050 models with Node-RED installed, not only the Advanced version.
Node-RED is a popular open-source, low-code tool for wiring machines, sensors, databases and cloud services together. Engineers drag "nodes" onto a canvas, connect them into "flows" and deploy them with one click. It runs on industrial gateways, Raspberry Pi boards, servers and edge PCs. That ease of use is the problem here: in the setup Siemens describes, anyone who could reach the Node-RED web interface on the gateway could deploy a flow, and some nodes can run system commands.
For machine builders and manufacturers who design in Autodesk Inventor, this is not only an IT story. Node-RED gateways often ship inside machines, sit next to PLCs on the shop floor, and share networks with the file servers and Vault systems that hold the design data. This article explains what is confirmed, what is not, and what Inventor teams that build or run connected machines should check this week.
TL;DR: CVE-2026-58115 lets an unauthenticated attacker deploy Node-RED flows on Siemens SIMATIC IoT2050 gateways with Node-RED installed and run code with maximum privileges. Siemens fixed it in Industrial OS V4.3.4-1 in August and on 4 November extended the advisory to the Advanced, Basic, M.2 and SM models. VulnCheck saw automated attacks on unprotected Node-RED decoys from 30 October.
VulnCheck has not seen Siemens devices being exploited, and nobody has published a count of affected systems. Still, any Node-RED editor reachable without a login is now a target. Machine builders should find every Node-RED instance they ship or run, update IoT2050 units, switch on authentication, check flows for unknown command nodes and web endpoints, rotate stored passwords, and keep dated records of what they delivered.
What happened?
Siemens first published security advisory SSA-834709 on 11 August 2026. It says that SIMATIC IoT2050 devices running Industrial OS with Node-RED installed "do not enforce authentication on the Node-RED HTTP interface". Through that interface, an attacker could create flows that use programming nodes "capable of executing system commands" and run arbitrary code on the device with maximum privileges. The flaw is tracked as CVE-2026-58115 and scores 10.0 in both CVSS 3.1 and CVSS 4.0.
On 27 October, VulnCheck released detection rules for the flaw. On 30 October, one of its canaries, a decoy system built to attract attackers, recorded a real attack. According to VulnCheck's report by Patrick Garrity, the same source address sent 16 attack requests against this vulnerability between 30 October and 1 November, with several different payloads. The address belongs to Microsoft's cloud network and also probed seven other software flaws, which VulnCheck reads as opportunistic mass scanning rather than a targeted attack on one company.
On 4 November, Siemens published version 1.1 of the advisory. It clarifies that the affected products are the SIMATIC IoT2050 Advanced, Basic, M.2 and SM, in all versions below V4.3.4-1, when Node-RED is installed. Earlier coverage had named only the Advanced model. As of the CISA catalogue dated 6 November, the flaw is not in the US government's list of known exploited vulnerabilities, although VulnCheck has added it to its own list.
How does the attack work?
Node-RED has an administration API that the browser editor uses to save and deploy flows. If that API has no login, anyone who can reach it can send a new flow. VulnCheck describes the captured request in one sentence: "The attacker's request was a complete exploit." A single web request deployed a flow with a trigger node that fires about one second after deployment, a node that runs a shell command, and a script that downloads a Linux program.
VulnCheck saw two kinds of results. In some cases, the flow downloaded a Linux bot into memory and started it. VulnCheck did not retrieve that program, so what it does is unknown. In other cases, the attackers did not install any program at all. They added a small web endpoint to the flow that runs whatever command arrives in its address. Because that backdoor is part of the saved flow, it survives a reboot. Cleaning up a gateway therefore means checking the flows, not only restarting the device.
What is confirmed, and what is not?
- Confirmed by Siemens: the flaw, its 10.0 rating, the four affected IoT2050 models, the fix in V4.3.4-1 and the workarounds. The Siemens advisory SSA-834709 does not say whether the flaw has been exploited.
- Confirmed by VulnCheck: automated attacks on Node-RED decoys without authentication from 30 October, the payloads, and the source address in Microsoft's cloud.
- Not confirmed: any attack on a real Siemens device. VulnCheck says it has not observed exploitation of Siemens products.
- Not known: how many IoT2050 gateways or Node-RED editors are exposed to the internet, and how many have been taken over. No vendor or researcher has published such a count.
The wider issue goes beyond Siemens. The Node-RED documentation states plainly: "By default, the Node-RED editor is not secured." Authentication has to be switched on in the settings file. VulnCheck's summary of the risk is direct: "Node-RED instances without adminAuth are being found and exploited automatically." Any team that set up Node-RED quickly for a pilot, a demo or a customer machine and never added a login should treat this as a reason to look.
Why should Inventor teams care?
Because many Inventor users are machine builders. They design the frame, the guarding, the electrical cabinet and, more and more, the connected parts: an edge gateway that collects machine data, sends alarms or feeds dashboards. A small Node-RED gateway in the cabinet is a common way to do that, and our guide to IoT integration in manufacturing with Autodesk Inventor describes how much of that work now starts on the design side.
Three things make this relevant to engineering teams in particular. First, the machine builder often chose and configured the gateway, so customers will ask the builder what is inside. Second, a Node-RED flow is code. Like an iLogic rule in an Inventor file, it can read and write data and run commands, and it deserves the same review. Third, gateways are often placed on networks that also reach file servers, ERP systems and Vault. A device that an attacker controls is a foothold, even if the attacker first came for something else.
We saw the same pattern days ago, when attackers heated supermarket fridges in Europe through old, internet-facing controllers. The devices differ, but the lesson for machine builders is the same: the connected parts you put in a machine become part of your product, your support load and your liability. In October, a Siemens Software Center flaw was abused in ClickFix attacks, which shows how quickly industrial software becomes a target once attackers have a working method.
What could an attacker reach through a Node-RED flow?
The table shows what usually sits in or around a Node-RED flow on a machine or in a plant, why it matters if someone else can deploy flows, and what to check.
Most of these points are standard Industry 4.0 security practice and part of data security in smart manufacturing. What this case adds is speed: the first attack VulnCheck caught came three days after it released its detection rules, and the requests were fully automated.
The machines you design carry your know-how. Keep proof of what you designed and delivered.
BORIS for Autodesk Inventor registers your CAD files with a blockchain timestamp and gives you a certificate of ownership, straight from Inventor.
👉 See how BORIS for Autodesk Inventor works
What does this mean for machine builders' obligations?
In the EU, connected parts in machines are moving under stricter rules. The Cyber Resilience Act already requires manufacturers of products with digital elements to report actively exploited vulnerabilities, and its main obligations apply from December 2027. The new product liability rules, which we described in our article on Germany's new Product Liability Act, also treat software and missing security updates as possible defects. A machine builder who integrates a third-party gateway should know which software versions it ships, how customers get updates and who tells them when an advisory like SSA-834709 appears.
Good records help here. If you can show which gateway firmware, which Node-RED settings and which flow version went into each machine, and when, you can answer customer questions quickly and show that you acted. The same records matter for design liability in engineering projects in general.
What should Inventor teams and machine builders do now?
- Find every Node-RED instance. List gateways, edge PCs and test boards in machines you have shipped, in your own plant and in your lab, including pilots set up outside IT.
- Update IoT2050 units. Move SIMATIC IoT2050 Advanced, Basic, M.2 and SM devices with Node-RED to Industrial OS V4.3.4-1 or later, or remove Node-RED where it is not used.
- Switch on authentication. Enable adminAuth on every Node-RED editor, use strong unique passwords and serve the editor over HTTPS.
- Take editors off the internet. The Node-RED editor port (1880 by default) should never be reachable from the internet. Use a VPN or a protected remote-access service for service work.
- Check the flows. Look for command nodes, web endpoints and flows you did not create, and compare them with your released version.
- Rotate stored logins. Change passwords and keys held in flows if a device was exposed, and use separate accounts per machine.
- Tell your customers. Send a short notice to customers whose machines contain affected gateways, with the update path and a contact.
- Keep dated records. Version your flows and gateway settings with the machine design, and register key design files and documents with BORIS so you can prove what you delivered and when.
Remember that the gateway is only one part of a wider picture. Engineering workstations are targets too, as the Binance attack that began on engineers' laptops showed last week. For the design data itself, see our guides to CAD file protection with Vault, encryption and proof of ownership and blockchain timestamps for proving design authorship.
The bigger picture
News on our sister sites this week circles the same question: who can reach your data, and what can you prove afterwards?
- Leaks and the money behind them. On CADChain, the LG Chem trade secret case shows Korea's Supreme Court ruling that payments made before the leak can also be confiscated, after a former expert passed on production details.
- Add-ins that read your files. BORIS for SOLIDWORKS looks at the MecAgent AI add-in and its terms for collecting open CAD files on the free plan, and what that means for NDAs and export-controlled designs.
- AI and other people's work. Blended BORIS covers the new lawsuits against Suno by Elvis Presley's and Eminem's rights holders, and what they mean for artists' records and registrations.
Conclusion
CVE-2026-58115 is not a complex attack. It is an open door: a Node-RED editor without a login on a device that can run commands. Siemens fixed its IoT2050 gateways in August, widened the advisory on 4 November, and automated attacks on unprotected Node-RED systems were already running by then. No real Siemens device has been confirmed as hit, but waiting for that confirmation is the wrong strategy.
For machine builders using Inventor, the connected parts of a machine now belong in the design process: chosen deliberately, configured securely, versioned with the design and documented for customers. Update the gateways, close the editors and check the flows. And keep dated proof of what you designed and delivered, so that your records hold up when customers, insurers or courts ask.
Your designs, your proof.
BORIS for Autodesk Inventor gives every registered file a blockchain timestamp and a certificate of ownership, straight from Inventor.
👉 Protect your Inventor designs with BORIS
FAQ: Node-RED, IoT2050 and CVE-2026-58115
What is CVE-2026-58115?
It is a missing-authentication flaw in Node-RED on Siemens SIMATIC IoT2050 devices with Industrial OS. The Node-RED web interface did not require a login, so a remote attacker could deploy flows that run system commands with maximum privileges. It is rated 10.0 in CVSS 3.1 and 4.0.
Which devices are affected?
According to Siemens advisory SSA-834709, version 1.1 of 4 November 2026: SIMATIC IoT2050 Advanced, Basic, M.2 and SM, all versions below V4.3.4-1, when Node-RED is installed.
Is it being exploited?
VulnCheck reported automated attacks on Node-RED decoy systems without authentication from 30 October 2026, with 16 events from one address by 1 November. It has not observed exploitation of Siemens devices, and the flaw was not in CISA's known exploited list as of 6 November.
How do I fix it?
Update IoT2050 devices to Industrial OS V4.3.4-1 or later. If you do not use Node-RED, uninstall it. Otherwise enable authentication, keep the editor off the internet and limit network access to the device.
Is a reboot enough after a suspected attack?
No. Some attackers added a web endpoint to the flow that runs commands, and it survives a reboot. Check the deployed flows against your own released version and rotate any stored passwords.
Does this affect Autodesk Inventor itself?
No. The flaw is in Node-RED on Siemens gateways. It matters to Inventor users because many of them design machines that include such gateways, and because gateways often share networks with design data.
How does BORIS help?
BORIS for Autodesk Inventor registers CAD files with a blockchain timestamp from inside Inventor, so you can show which version of a design existed and when. It does not patch gateways or replace network security.