Node-RED: a CVSS 10 flaw exploited in the wild is targeting industrial gateways

VulnCheck has observed real-world exploitation of CVE-2026-58115, a CVSS 10 authentication flaw in Node-RED that hands code execution on embedded industrial gateways to a remote attacker. Teams running Node-RED should check today that the editor is not exposed and audit their flows for exec nodes.