CVE-2026-123807
CriticalCVSS 9.8Summary
Signal K Server versions 2.0.0 through 2.33.x and @signalk/resources-provider 1.0.0 through 1.5.2 have a REST route GET /signalk/v2/api/resources/:resourceType/:resourceId that accepts an unsafe resourceId able to escape the intended resource directory. Lack of path containment allows reading arbitrary JSON files reachable by the server, and related PUT and DELETE operations can write or delete files outside the storage root. Reading security.json exposes the HS256 JWT signing secret and password hashes, enabling forged admin tokens and further escalation.
Risk Assessment
An attacker can read sensitive files, including JWT secrets and password hashes, then forge an administrator token and gain command execution on the server. In deployments with allow_readonly enabled, the attack requires no authentication.
Recommendation
Update Signal K Server to 2.34.0 and @signalk/resources-provider to 1.5.3. Until patched, restrict access to resource routes and disable allow_readonly if possible.
Other vulnerabilities in Signal K Server
See all- CVE-2026-118690Critical
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the `/skServer/ziplogs` endpoint. Attackers can extract the JWT `secretKey` from `security.json` in the ZIP, forge administrator tokens, and create persistent admin accounts. This is fixed in version 2.33.0.
- CVE-2026-33950Critical
Signal K Server before version 2.24.0-beta.4 has a privilege escalation vulnerability via admin role injection in the /enableSecurity endpoint. An unauthenticated attacker can gain full administrative access.
- CVE-2025-68620Critical
Signal K Server before version 2.19.0 contains two vulnerabilities that can be chained to steal JWT tokens without any authentication. The first is unauthenticated WebSocket request enumeration via the serverevents=all parameter, and the second is unauthenticated polling of access request status, which returns the JWT token in plaintext after an administrator approves the request.
- CVE-2025-66398Critical
Signal K Server before version 2.19.0 allows an unauthenticated attacker to pollute the internal state (restoreFilePath) via the /skServer/validateBackup endpoint, enabling hijacking of the administrator's Restore functionality to overwrite critical configuration files, leading to account takeover and RCE.
- CVE-2026-115752Medium
Signal K Server from 2.28.0-beta.2 before 2.34.0 contains an SSRF vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud metadata endpoints, with image responses stored and served via the admin UI.
- CVE-2026-55591Medium
Signal K Server prior to 2.28.0 has a vulnerability in makeRemoteRequest() that accepts attacker-controlled host, port, useTLS, and selfsignedcert parameters without validating the destination. When security is not configured, the endpoints testSignalKConnection, requestAccess, and checkAccessRequest are accessible without authentication, allowing port scanning, exfiltration of cloud metadata and internal service data, and lateral movement.
- CVE-2026-41893High
Signal K Server prior to version 2.25.0 protects HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) with express-rate-limit (default: 100 attempts per 10-minute window). However, the WebSocket login path — sending {login: {username, password}} messages over an established WebSocket connection — calls app.securityStrategy.login() directly without any rate limiting. An attacker can bypass HTTP rate limiting entirely by opening a WebSocket connection and attempting unlimited password guesses at the speed bcrypt allows (~20 attempts/sec with 10 salt rounds). This issue has been fixed in version 2.25.0.
- CVE-2026-35038Medium
Signal K Server before version 2.24.0 has a prototype read vulnerability via `from` field bypass. A low-privileged authenticated user can bypass prototype boundary filtering to read internal functions and properties from the global prototype object.
- CVE-2026-34083Medium
Signal K Server before version 2.24.0 has a vulnerability in OIDC login/logout handlers where the unvalidated Host header is used to construct the OAuth2 redirect_uri. Since redirectUri is unset by default, an attacker can spoof the Host header to steal OAuth authorization codes and hijack user sessions.
- CVE-2026-33951High
Signal K Server before version 2.24.0-beta.1 exposes an unauthenticated HTTP endpoint PUT /signalk/v1/api/sourcePriorities that allows remote attackers to modify navigation data source priorities. Changes are applied immediately and persisted.
Original NVD description (English source)
Signal K Server is a server application that runs on a central hub in a boat. From 2.0.0 until 2.34.0 for Signal K Server and from 1.0.0 until 1.5.3 for @signalk/resources-provider, the v2 REST route GET /signalk/v2/api/resources/:resourceType/:resourceId accepts an unsafe resourceId that can escape the intended resource directory. The route passes the attacker-controlled resourceId through src/api/resources/index.ts to FileStore.getResource() in packages/resources-provider-plugin/src/filestorage.ts without adequate path containment, allowing arbitrary JSON files reachable by the server to be read. Related PUT and DELETE resource operations can write or delete files outside the storage root. Deployments with allow_readonly enabled permit anonymous reads, while other deployments require a readonly user token. Reading security.json exposes the HS256 JWT signing secret and password hashes, allowing an attacker to forge an administrator token. Administrative access to POST /skServer/providers can then create an Execute provider that runs commands with the server process privileges and persists its configuration across restarts. This issue is fixed in Signal K Server 2.34.0 and @signalk/resources-provider 1.5.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS