{"id":"CVE-2026-77052","kind":"vulnerability","aliases":["CVE-2026-77052"],"related":[],"title":"boneIO Black: unauthenticated Node-RED admin lets local attackers run commands","description":"boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system.\n\n\nThis issue was fixed in version 1.6.0.","summary":"boneIO Black exposes a Node-RED instance at /nodered/ through a Caddy reverse proxy with no authentication. An attacker on the local network can deploy a flow through the Admin API that executes arbitrary system commands, giving full control of the home automation system.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["boneio","caddy","home-automation","infrastructure","node-red","raspberry-pi","self-hosted"],"not_affected_if":["boneio-version-1.6.0-or-later","nodered-path-blocked"],"how_to_check":"- Open `/nodered/` on the boneIO Black host from another machine on the LAN and see whether the Node-RED editor loads without a login prompt\n- Check the installed boneIO version and confirm it is below `1.6.0`","fix":"- Update boneIO Black to `1.6.0` or later, which fixes the exposure\n- Until updated, block or restrict access to `/nodered/` at the Caddy proxy or network level","status":"open","published_at":"2026-10-26T15:16:42+00:00","first_seen_at":"2026-10-26T16:02:25+00:00","triaged_at":"2026-10-26T16:03:37+00:00","updated_at":"2026-10-26T16:03:37+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-26T16:03:37Z","model":"claude-haiku-5-5","output":{"fix":"- Update boneIO Black to `1.6.0` or later, which fixes the exposure\n- Until updated, block or restrict access to `/nodered/` at the Caddy proxy or network level","reach":"network","title":"boneIO Black: unauthenticated Node-RED admin lets local attackers run commands","impact":"high","summary":"boneIO Black exposes a Node-RED instance at /nodered/ through a Caddy reverse proxy with no authentication. An attacker on the local network can deploy a flow through the Admin API that executes arbitrary system commands, giving full control of the home automation system.","category":"infrastructure","nicknames":[],"who_cares":["boneio","home-automation","node-red","caddy","self-hosted","raspberry-pi"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs arbitrary system commands and takes full control of the device.","analyst_note":"","how_to_check":"- Open `/nodered/` on the boneIO Black host from another machine on the LAN and see whether the Node-RED editor loads without a login prompt\n- Check the installed boneIO version and confirm it is below `1.6.0`","needs_analyst":false,"not_affected_if":["boneio-version-1.6.0-or-later","nodered-path-blocked"],"who_is_affected":"Owners of boneIO Black home automation boxes running a version before `1.6.0` where Node-RED is reachable through the Caddy proxy path /nodered/. Attackers need only network reach to that path, with no account. Systems that do not run boneIO Black or that block the /nodered/ path are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000631,"input_tokens":3356,"output_tokens":590,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-77052':15A,18A '/nodered':43B,91C '1.6.0':145C 'achiev':126C 'admin':7A,64B,102C 'allow':104C 'api':65B,103C 'arbitrari':68B,110C 'attack':10A,53B,115C 'authent':51B,88C 'autom':23B,77B,137C 'black':2A,35B,80C 'boneio':1A,19B,34B,79C 'caddi':20B,46B,95C 'code':128C 'command':12A,70B,112C 'control':73B,133C 'cve':13A,16A 'deploy':59B,105C,121C 'execut':67B,109C,129C 'expos':36B,81C 'fix':142C 'flow':61B,106C,124C 'full':72B,132C 'gain':131C 'give':71B 'home':22B,76B,136C 'home-autom':21B 'host':33B 'infrastructur':24B 'instanc':41B,86C 'issu':140C 'let':8A 'local':9A,56B,118C 'malici':123C 'network':57B,119C 'node':5A,26B,39B,84C,100C 'node-r':4A,25B,38B,83C,99C 'path':92C 'pi':30B 'proxi':48B,97C 'raspberri':29B 'raspberry-pi':28B 'red':6A,27B,40B,85C,101C 'remot':127C 'revers':47B,96C 'run':11A 'self':32B 'self-host':31B 'system':69B,78B,111C,138C 'unauthent':3A,114C 'version':144C 'without':87C","nicknames":[],"mitigations":[],"who_affected":"Owners of boneIO Black home automation boxes running a version before `1.6.0` where Node-RED is reachable through the Caddy proxy path /nodered/. Attackers need only network reach to that path, with no account. Systems that do not run boneIO Black or that block the /nodered/ path are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77052","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77052","severity":null,"published_at":"2026-10-26T15:16:42+00:00","modified_at":"2026-10-26T15:16:42+00:00","first_seen_at":"2026-10-26T16:02:25+00:00","fetched_at":"2026-10-26T16:02:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}