Critical Node-RED Flaw Exploited in Attacks

# Critical Node-RED Flaw Exploited in Attacks

https://gcdradar.vercel.app/incidents/critical-node-red-flaw-exploited-in-attacks · AIR-2026-1750 · live

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Confirmed exploitation in the wild against real targets.
- Fix status: Fix status unknown
- First reported: 2026-11-03
- AI role: No AI role
- Products: Node-RED

## Summary

Threat actors actively exploited a critical vulnerability in Node-RED to deploy malicious payloads including Linux bots and webshells. Multiple attack attempts originated from the same IP address.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-11-03: Critical Node-RED Flaw Exploited in Attacks (https://securityweek.com/critical-node-red-flaw-exploited-in-attacks)

## Sources

- 2026-11-03 SecurityWeek: Critical Node-RED Flaw Exploited in Attacks https://securityweek.com/critical-node-red-flaw-exploited-in-attacks

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.