What is the CVSS score of CVE-2026-71269?

CVE-2026-71269 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Node-RED are affected by CVE-2026-71269?

A path traversal vulnerability in Node-RED's library storage API (CVE-2026-71269, CVSS 7.2) allows any authenticated user to read arbitrary files from affected servers, with escalation to remote code…

How to fix or mitigate CVE-2026-71269?

Within 24 hours, inventory all Node-RED instances and identify deployed versions, then audit and immediately downscope or revoke all API tokens and user accounts with write-access permissions-keeping only the minimum necessary write-level credentials for essential operations. Within 7 days, implement network-level access controls restricting the library storage API endpoints (GET/POST /library/:lib/:type/*path) to authorized administrators only, and enable detailed logging and alerting on all library API requests. Within 30 days, evaluate longer-term mitigations with your operations team including disabling the library storage API entirely if not required for your workflows, isolating Node-RED instances to restricted network segments, containerizing deployments with read-only filesystems where feasible, and maintaining monitoring of Node-RED project advisories for vendor-released patches.

Node-RED CVE-2026-71269

EUVD-2026-53354 HIGH

Path Traversal (CWE-22)

2026-08-05 TuranSec

GHSA-f3wc-7g8m-89m9

RCE Path Traversal Node Red

7.2

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

PR:L reflects that arbitrary file read is reachable by any authenticated user including read-only tokens; A:N because no direct availability impact is described in the vulnerability.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 13:37 vuln.today

CVE Published

Aug 05, 2026 - 12:26 cve.org

HIGH 7.2

DescriptionCVE.org

Node-RED's local-filesystem library storage module (getLibraryEntry() and saveLibraryEntry() in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js), reachable via GET/POST /library/:lib/:type/*path, joins the user-supplied path parameter directly into the filesystem path via fspath.join(libDir, type, path) with no traversal sanitization, containment check, or path normalization/prefix verification. An authenticated user (including read-only-scoped tokens for the read path) can supply a path containing ../ sequences to read arbitrary files outside the library directory; a user with write access can write arbitrary files, enabling remote code execution via SSH authorized_keys or cron injection. This is a distinct, separately unpatched traversal from the previously fixed CVE-2021-21298 (Projects API).

AnalysisAI

Path traversal in Node-RED's library storage API (GET/POST /library/:lib/:type/*path) allows any authenticated user - including those holding read-only scoped API tokens - to read arbitrary files outside the library directory by injecting ../ sequences into the path parameter. Users with write-access credentials can escalate to remote code execution by writing attacker-controlled content to SSH authorized_keys files or system cron directories. This vulnerability is distinct from the previously patched CVE-2021-21298 (Projects API traversal), affects all published Node-RED versions per CPE wildcard, carries no vendor-released patch at time of analysis, and has no confirmed active exploitation or CISA KEV listing.

Technical ContextAI

Node-RED is a Node.js-based flow programming runtime exposing a REST API for managing user libraries. The vulnerable code in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js constructs filesystem paths via fspath.join(libDir, type, path), where path is taken verbatim from the HTTP request parameter with no sanitization, prefix verification, normalization, or containment check to ensure the resolved path stays within the intended library directory. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) identifies the root cause: unchecked user-supplied input in path construction. Both the GET handler (getLibraryEntry) and the POST handler (saveLibraryEntry) share this flaw, making the vulnerability bidirectional - arbitrary file read and arbitrary file write are both exposed through the same missing sanitization. The CPE cpe:2.3:a:node-red:node-red:*:*:*:*:*:*:*:* confirms no version bound exists; all published releases are affected.

RemediationAI

No vendor-released patch has been identified at time of analysis; the Node-RED GitHub repository at https://github.com/node-red/node-red should be monitored closely for a fix and any released patch applied immediately. The most impactful interim control is to restrict network access to the /library/ API endpoint to trusted, internal networks only using a reverse proxy or firewall rule, reducing the pool of users who can reach the vulnerable handler - the trade-off is that this blocks legitimate remote library management workflows. For the write-to-RCE path specifically, run Node-RED as a dedicated low-privilege OS user account that has no write access to sensitive filesystem locations such as ~/.ssh/authorized_keys, /etc/cron*, or /var/spool/cron - even a successful file-write traversal will then be unable to escalate to OS-level shell access; the trade-off is additional OS configuration overhead but this control is highly effective and should be applied regardless of patch status. Operators should also audit currently issued write-scoped API tokens and revoke any that are not operationally necessary, limiting the exploitable credential surface. Defenders with log access should monitor HTTP access logs for /library/ requests containing literal or URL-encoded ../ sequences as an indicator of active traversal attempts.