HIGH 8.7 NVD

CVE-2026-77052

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flo

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system. This issue was fixed in version 1.6.0.

References

https://boneio.eu/en/docs/black
https://cert.pl/en/posts/2026/10/CVE-2026-77052

Published: 2026-10-26 · Source: NVD · Feed updated: 2026-10-26

This high severity vulnerability with a CVSS score of 8.7 was published on 2026-10-26 via NVD.

vulnfeed aggregates 18200 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.