Description
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system.


This issue was fixed in version 1.6.0.
Published: 2026-10-26
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Patch Now
AI Analysis

Impact

boneIO Black allows an unauthenticated local user to reach a Node‑RED instance at the /nodered/ path. The Node‑RED Admin API provides the ability to deploy flows, and those flows can execute arbitrary system commands, giving attackers the ability to run any command on the host. This results in full compromise of the home automation system's confidentiality, integrity, and availability.

Affected Systems

The affected product is boneIO boneIO. All versions prior to 1.6.0 are vulnerable. The fix is delivered in version 1.6.0 and later.

Risk and Exploitability

The high severity CVSS score of 8.7 reflects that a successful exploit results in remote code execution. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker who can access the local network to send a flow deployment request via the unprotected Node‑RED Admin API.

Generated by OpenCVE AI on October 26, 2026 at 16:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade boneIO to version 1.6.0 or later.
  • If upgrade is not immediately possible, configure the Caddy reverse proxy to require authentication for the /nodered/ path or block external access to that path.
  • Disable or restrict the Node‑RED Admin API by editing the Node‑RED settings file or using a firewall to ensure only trusted hosts can send flow deployment requests.

Generated by OpenCVE AI on October 26, 2026 at 16:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system. This issue was fixed in version 1.6.0.
Title Missing Authentication for Node-RED in boneIO
First Time appeared Boneio
Boneio boneio
Weaknesses CWE-306
CPEs cpe:2.3:a:boneio:boneio:*:*:*:*:*:*:*:*
Vendors & Products Boneio
Boneio boneio
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L'}

Subscriptions

Boneio Boneio
cve-icon MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published:

Updated: 2026-10-26T14:45:37.056Z

Reserved: 2026-08-20T09:37:37.786Z

Link: CVE-2026-77052

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-26T15:16:42.660

Modified: 2026-10-26T17:11:35.487

Link: CVE-2026-77052

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T16:30:11Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function