Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-77052: boneio exposes Node-RED allowing anyone to run code

CVE-2026-77052 · published 1 day ago

Summary

The boneio home‑automation device serves a Node‑RED interface without requiring a login. Because the admin API can install flows that execute system commands, anyone on the same network could upload a malicious flow and take full control of the system. Updating to version 1.6.0 resolves the issue.

What to do

Update boneio boneio to version 1.6.0 or later.

Affected software

Vendor	Product	Affected versions
boneio	boneio	< 1.6.0

Original advisory text

Missing Authentication for Node-RED in boneIO

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system.

This issue was fixed in version 1.6.0.

References

https://boneio.eu/en/docs/black URL
https://cert.pl/en/posts/2026/10/CVE-2026-77052 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77052... Vendor Advisory
https://github.com/boneIO-eu/app_black Product
https://nvd.nist.gov/vuln/detail/CVE-2026-77052 Vendor Advisory
https://pypi.python.org URL

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

9.4 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-306Missing Authentication for Critical Function

Timeline

Published26 Oct 2026

Updated27 Oct 2026

First seen26 Oct 2026

Sources

CVE-2026-77052 · NVD

CVE-2026-77052 · MITRE

CVE-2026-77052 · OSV

Track software like this

Free during beta