CVE-2026-71269: Node-RED Path Traversal Vulnerability

CVE-2026-71269 Overview

CVE-2026-71269 is a path traversal vulnerability [CWE-22] in Node-RED's local-filesystem library storage module. The flaw affects the getLibraryEntry() and saveLibraryEntry() functions in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js. The GET/POST /library/:lib/:type/*path routes join the user-supplied path directly into the filesystem path using fspath.join(libDir, type, path) without traversal sanitization, containment checks, or prefix verification. Authenticated attackers can read or write files outside the library directory. This issue is distinct from the previously patched CVE-2021-21298 affecting the Projects API.

Critical Impact
Authenticated users with write scope can achieve remote code execution by writing arbitrary files such as SSH authorized_keys or cron entries.

Affected Products

Node-RED (local-filesystem storage module)
Deployments exposing /library/:lib/:type/*path endpoints
Instances relying on read-only-scoped tokens for library access

Discovery Timeline

2026-08-05 - CVE-2026-71269 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71269

Vulnerability Analysis

The Node-RED runtime exposes library storage through HTTP endpoints that accept an arbitrary path segment. The handler passes the raw path parameter into fspath.join(libDir, type, path) and reads or writes the resulting file. Because path.join collapses ../ segments without enforcing that the result remains inside libDir, an attacker can escape the intended directory. The read path (getLibraryEntry()) is reachable with any authenticated token, including tokens scoped read-only. The write path (saveLibraryEntry()) requires write scope but produces arbitrary file writes on the host running the Node-RED process.

Root Cause

The root cause is missing containment validation after path concatenation. The module trusts the joined path without normalizing it and verifying it starts with the canonical libDir prefix. Standard hardening patterns such as path.resolve() followed by a startsWith(libDir) guard are absent from both accessor functions.

Attack Vector

An authenticated attacker sends a request such as GET /library/local/flows/../../../../etc/passwd to read files outside the library root. With write privileges, the attacker issues a POST to a similar path targeting locations like ~/.ssh/authorized_keys or /etc/cron.d/. Writing an SSH key or a cron job yields remote code execution as the Node-RED service account.

No verified proof-of-concept code has been published. See the Node-RED local-filesystem library source for the affected functions.

Detection Methods for CVE-2026-71269

Indicators of Compromise

HTTP requests to /library/:lib/:type/* containing ../ or URL-encoded %2e%2e%2f sequences
Unexpected file writes to ~/.ssh/authorized_keys, /etc/cron.d/, or other sensitive paths by the Node-RED process
New or modified files outside the configured userDir/lib directory tree
Outbound SSH connections originating shortly after suspicious library API activity

Detection Strategies

Enable HTTP access logging on the Node-RED admin API and alert on library routes containing traversal sequences
Monitor filesystem writes by the Node-RED process outside its expected userDir using auditd or eBPF file integrity tooling
Correlate authenticated library API calls with subsequent process execution or credential file changes

Monitoring Recommendations

Baseline normal library API paths and alert on deviations, especially requests referencing paths outside alphanumeric flow names
Track authentication token scope usage and flag read-only tokens accessing unusual resources
Forward Node-RED runtime logs to a centralized platform for retrospective analysis of /library/ traffic

How to Mitigate CVE-2026-71269

Immediate Actions Required

Restrict network access to the Node-RED admin and library endpoints to trusted management networks only
Revoke or rotate any long-lived API tokens, including read-only-scoped tokens, until the fix is applied
Run the Node-RED process under a dedicated unprivileged user with no shell or SSH key material
Audit authorized_keys, cron directories, and startup scripts on hosts running Node-RED for unexpected modifications

Patch Information

At publication, no vendor patch is listed in the NVD record for CVE-2026-71269. Monitor the Node-RED GitHub repository for a security release addressing getLibraryEntry() and saveLibraryEntry() traversal handling. Apply the fix immediately once available.

Workarounds

Place Node-RED behind a reverse proxy that rejects requests containing .., %2e%2e, or absolute paths on /library/ routes
Run Node-RED inside a container or chroot with minimal filesystem access so traversal reads cannot reach sensitive host files
Enforce mandatory access control policies (AppArmor or SELinux) restricting the Node-RED process to its userDir
Disable the library API entirely if it is not required by editing the runtime configuration

bash

# Example nginx location block to block traversal on Node-RED library routes
location ~ ^/library/ {
    if ($request_uri ~* "(\.\./|%2e%2e%2f|%2e%2e/)") {
        return 400;
    }
    proxy_pass http://127.0.0.1:1880;
}