CVE-2026-77052: high-severity vulnerability in boneIO
Missing Authentication for Node-RED in boneIO
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.3%
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system.
This issue was fixed in version 1.6.0.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Affected products
boneIO · boneIORelated CVEs — boneIO
In the same product, most dangerous first.
CVE-2026-77062MEDIUMClickjacking in boneIOEPSS 0.5%CVE-2026-77061MEDIUMMissing Authentication for Critical Function in boneIOEPSS 0.3%CVE-2026-77057LOWImproper Restriction of Excessive Authentication Attempts in boneIOEPSS 0.3%CVE-2026-77058MEDIUMCross-Site Request Forgery (CSRF) in boneIOEPSS 0.3%CVE-2026-77053HIGHMissing Authentication in Default Configuration in boneIOEPSS 0.3%CVE-2026-77054MEDIUMCleartext Storage of Sensitive Information in boneIOEPSS 0.2%