Missing Authentication Vulnerability in Signal K Server
CVE-2026-118690

9.3CRITICAL

Key Information:

Vendor

Signalk

Status
Signalk-server
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118690?

Signal K Server versions prior to 2.33.0 exhibit a critical missing authentication vulnerability. This flaw enables unauthorized remote attackers to access and download log archives through the vulnerable '/skServer/ziplogs' endpoint. By exploiting this vulnerability, attackers can obtain the JWT secretKey from the downloaded security.json file within the ZIP. This allows them to forge administrator tokens and establish persistent admin accounts, giving them complete control over the server. It is essential for users to update to version 2.33.0 or later to mitigate this security risk.

Affected Version(s)

signalk-server 0 < 2.33.0

signalk-server 2.33.0

References

https://github.com/SignalK/signalk-server/commit/728bab82...
patch
https://github.com/SignalK/signalk-server
product
https://github.com/SignalK/signalk-server/security/adviso...
vendor-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

tkurki
Taqiyuddin Anas
.