Admin API remains externally accessible after configuring adminHost for localhost

Direct answer

Setting adminHost to 127.0.0.1 alone does not guarantee that the Node‑RED admin API is unreachable from external hosts.

Why this happens (likely explanation)

The adminHost option controls the interface on which the editor UI is served. In many Node‑RED deployments the underlying admin HTTP API shares the same listener, but some installations expose the API on a separate port or bind it to 0.0.0.0 regardless of the UI setting. If the API listener remains on all interfaces, external clients can still reach it.

Confirmed facts

• The adminHost value is read from settings.js and applied when the Node‑RED process starts.
• Changing adminHost requires a restart of the Node‑RED service for the new binding to take effect.
• Network tools such as netstat -tlnp or ss -tlnp show the actual address and port the API is listening on.

Steps to verify and fix for this case

1. Locate the Node‑RED settings.js and confirm adminHost is set to "127.0.0.1".
2. Restart the Node‑RED process (e.g., systemctl restart nodered or whichever method you use).
3. Run ss -tlnp | grep :1880 (replace 1880 with your admin port) and note the address shown in the Local Address:Port column.
4. If the address shows 0.0.0.0:1880 or [::]:1880, the API is still bound to all interfaces.
5. To bind the API to localhost, ensure adminHost is correctly set and that no other configuration (e.g., command‑line --host flag) overrides it. After correcting, restart again and repeat the ss check.
6. Optionally, add a firewall rule to block external traffic to the admin port as a defense‑in‑depth measure.

What you need to confirm

Please provide the output of the ss -tlnp (or netstat -tlnp) line for the admin API port so we can verify whether the listener is already on 127.0.0.1 or still on 0.0.0.0. This detail determines whether a simple restart suffices or if additional binding overrides must be investigated.