Live › vulnerability › CVE-2026-77052
Go to dashboardboneIO Black exposes a Node-RED instance at /nodered/ through a Caddy reverse proxy with no authentication. An attacker on the local network can deploy a flow through the Admin API that executes arbitrary system commands, giving full control of the home automation system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Owners of boneIO Black home automation boxes running a version before where Node-RED is reachable through the Caddy proxy path /nodered/. Attackers need only network reach to that path, with no account. Systems that do not run boneIO Black or that block the /nodered/ path are not affected.
1.6.0No product ranges from the sources yet.
/nodered/ on the boneIO Black host from another machine on the LAN and see whether the Node-RED editor loads without a login prompt1.6.01.6.0 or later, which fixes the exposure/nodered/ at the Caddy proxy or network levelEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system.
This issue was fixed in version 1.6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-77052")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.