---
id: CVE-2026-77052
title: Missing Authentication for Node-RED in boneIO
summary: >-
  boneIO Black exposes a Node-RED instance without authentication at the
  /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows
  deploying flows that can execute arbitrary system commands. An unauthenticated
  attacker on…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L'
cvssSource: cna
cwe:
  - CWE-306
vendor: boneIO
product: boneio
affected:
  - boneio >= 1.3.0 < 1.6.0
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T14:45:37.056Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-77052'
references:
  - url: 'https://cert.pl/en/posts/2026/10/CVE-2026-77052'
  - url: 'https://boneio.eu/en/docs/black'
tags:
  - cve.org
ingestedAt: '2026-10-26T15:29:30.513Z'
epss: 0.00331
epssPercentile: 0.26188
---

## Overview

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system.


This issue was fixed in version 1.6.0.

## Affected

- `boneio >= 1.3.0 < 1.6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.