CVE-2026-77052

Vulnerability Description

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system. This issue was fixed in version 1.6.0.

Related Weaknesses (CWE)

References

• https://boneio.eu/en/docs/black
• https://cert.pl/en/posts/2026/10/CVE-2026-77052

FAQ

What is CVE-2026-77052?

CVE-2026-77052 is a documented vulnerability. boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system com...

How severe is CVE-2026-77052?

CVSS scoring is not yet available for CVE-2026-77052. Check NVD for updates.

Is there a patch for CVE-2026-77052?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.