CVE-2026-77052: Missing Authentication for Node-RED in boneIO

Q: Who can exploit this issue?

An unauthenticated attacker who can reach the boneIO Black device on the local network can access the exposed Node-RED instance and deploy a malicious flow.

Q: What level of access can an attacker obtain?

By deploying flows through the Node-RED Admin API, an attacker can execute arbitrary system commands. This can give them full control of the home automation system.

Q: How can I determine whether my device is affected?

Check whether the device exposes Node-RED through the /nodered/ path without requiring authentication. Systems running a version earlier than 1.6.0 are affected.

Q: What is the remediation?

Update boneIO Black to version 1.6.0, which fixes the issue. Until updating, restrict access to the device from untrusted local-network users.

Published Oct 26, 2026

Updated

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system.

This issue was fixed in version 1.6.0.

Affected Software

1 affected component

boneIO boneIO Black<1.6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade boneIO to a version that resolves this vulnerability.
Fixed in 1.6.0

Event History

Oct 26, 2026

CVE Published

via MITRE·02:45 PM

Data Sourced

via MITRE·02:45 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker who can reach the boneIO Black device on the local network can access the exposed Node-RED instance and deploy a malicious flow.

What level of access can an attacker obtain?

By deploying flows through the Node-RED Admin API, an attacker can execute arbitrary system commands. This can give them full control of the home automation system.

How can I determine whether my device is affected?

Check whether the device exposes Node-RED through the /nodered/ path without requiring authentication. Systems running a version earlier than 1.6.0 are affected.

What is the remediation?

Update boneIO Black to version 1.6.0, which fixes the issue. Until updating, restrict access to the device from untrusted local-network users.

CVE-2026-77052: Missing Authentication for Node-RED in boneIO

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What level of access can an attacker obtain?

How can I determine whether my device is affected?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What level of access can an attacker obtain?

How can I determine whether my device is affected?

What is the remediation?