Server-side Request Forgery Vulnerability in Signal K Server by Signal K
CVE-2026-115752

2.3LOW

Key Information:

Vendor

Signalk

Status
Signalk-server
Vendor
CVE Published:
23 October 2026

What is CVE-2026-115752?

Signal K Server versions prior to 2.34.0 are susceptible to a server-side request forgery (SSRF) vulnerability that arises in the App Store icon fetcher. The issue stems from the product's trust in absolute signalk.appIcon URLs, enabling adversaries to exploit this oversight. By crafting malicious npm packages containing Signal K keywords, attackers can manipulate servers into requesting loopback, vessel network, or cloud metadata endpoints. This results in the potential storage and exposure of sensitive image-typed responses via the administrative user interface.

Affected Version(s)

signalk-server 2.28.0-beta.2 < 2.34.0

References

https://github.com/SignalK/signalk-server/security/adviso...
vendor-advisory
https://github.com/SignalK/signalk-server/commit/535104f6...
patch
https://github.com/SignalK/signalk-server/releases/tag/v2...
release-notes

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zachariah Mithani (AploSec)
.