CVE-2026-58115: Unauthenticated Node-RED Admin API Enables Full Takeover of Siemens Industrial Gateway

·4 views

A critical vulnerability, CVE-2026-58115 with a CVSS score of 10.0, affects Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED before version V4.3.4.1. Node-RED's editor and Admin API lack authentication by default, and on the affected product this setting was left off, letting a remote attacker deploy flows that execute arbitrary commands with maximum privileges. The flaw stems from a missing authorization boundary rather than a code bug, and the attack relies only on built-in inject and exec nodes, which makes it hard to distinguish from normal automation. Siemens disclosed the issue on August 11, 2026, and researchers at VulnCheck recorded a live exploitation attempt on October 30, 2026, three days after publishing a detection signature. Siemens recommends upgrading to Industrial OS V4.3.4.1 or later.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

ByteStash API Keys Stayed Valid After Account Deactivation (CVE-2026-126658)

A flaw in ByteStash versions 1.5.10 through 1.6.2 lets API keys keep working after the owning account has been deactivated. The API-key validation path does not verify whether the account is still active, so administrators who disable a user may believe access has ended when it has not. Any holder of a surviving key, including a former user, a compromised client, or an automation, could keep reading or modifying stored snippets, which may contain sensitive internal material. The recommended remedy is upgrading to version 1.6.2 and confirming that deactivated keys are rejected, along with auditing and rotating keys and reviewing logs for post-deactivation use. Organizations unable to upgrade immediately should restrict API and MCP access as a temporary measure, since this does not fix the underlying account-status check.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Building a Podcast Intro Generator with ElevenLabs Text-to-Speech

A DEV Community tutorial explains how to automate podcast intros using text-to-speech technology, since recording a new intro for every episode is time-consuming for solo creators. The proposed pipeline gathers the episode title and tagline, merges them into a script template, sends the text to the ElevenLabs API, and post-processes the audio with fades and loudness normalization. The author provides a Python wrapper that handles authentication, voice selection, and saving the returned audio as an MP3 file. The article also suggests cloning one's own voice in the ElevenLabs dashboard for consistent branding across episodes, and recommends using a templating tool such as Jinja2 to inject episode-specific details. The tutorial includes a referral link to ElevenLabs for obtaining an API key.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

What a SERP API Is and How Its Pricing Compares in 2026

A SERP API converts a search engine results page into structured JSON, returning fields such as position, title, URL, and snippet along with optional modules. The author notes it fetches live pages rather than crawling or indexing, so stored data cannot be re-fetched and parsers must adapt to layout changes. Responses include a status field, since an HTTP 200 can still carry a parse error, plus a request ID and the credits charged per call. Using price figures from a public comparison table checked in late October 2026, the article shows that at a $200 monthly budget, SerpBase, Serper, and SerpApi differ roughly 28-fold in how many searches they deliver. The author cautions that coverage varies between providers and that cheaper options may lack needed fields.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Use Deterministic Code Before Calling an LLM in AI Agents

A common assumption in AI application design is that an LLM should handle every decision, but this can be wasteful. The article argues that recurring problems with known solutions can be converted into ordinary deterministic functions. In an example of an agent analyzing failed CI/CD builds, a repeated NuGet error can be resolved by simple pattern-matching code instead of a fresh model call. The author recommends a division of labor where code handles known patterns and explicit rules while the LLM tackles ambiguous or unfamiliar cases. Deterministic logic also offers the benefits of lower inference costs, faster responses, and predictable behavior.

0 comments Read more at DEV Community