CVE-2026-77052
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a…
- Risk score
- 52/100
- CVSS
- 8.7 v4.0
- Published
- 26 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution an…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.6.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.7 high
References
Original description
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system. This issue was fixed in version 1.6.0.
Last activity 26 Oct 2026. Patch Forecast updates every hour.