CVE-2026-77052
Missing Authentication for Node-RED in boneIO
boneIO boneIO
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 1.6.0boneIOCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system.
This issue was fixed in version 1.6.0.
Text from CVE List
Affected versions 1
- boneIOaffected: 1.3.0 before 1.6.0CVE List