Skip to content
OpenAdvisories

Vendor

SignalK

18 known vulnerabilities.

Products

signalk-server 18 resources-provider 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-123807 Public exploit

    Signal K Server: Unauthenticated path traversal in resources-provider v2 API leads to JWT secret disclosure, admin impersonation and remote code execution

    Signal K Server is a server application that runs on a central hub in a boat. From 2.0.0 until 2.34.0 for Signal K Server and from 1.0.0 until 1.5.3 for @signalk/resources-provider, the v2 REST route GET /signalk/v2/api/resources/:resourceType/:resourceId acc…

    SignalK signalk-server resources-provider
  • Critical 9.8
    CVE-2026-118690

    Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs

    Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forg…

    SignalK signalk-server
  • Critical 9.4
    CVE-2026-33950

    signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity

    Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a privilege escalation vulnerability by Admin Role Injection via /enableSecurity. An unauthenticated attacker can gain full Administrator ac…

    SignalK signalk-server signalk-server npm
  • Critical 10.0
    CVE-2026-23515

    RCE - Command Injection in Signal K set-system-time plugin

    Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-ti…

    SignalK signalk-server @signalk/set-system-time npm
  • Critical 9.1
    CVE-2025-68620

    Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling

    Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 expose two features that can be chained together to steal JWT authentication tokens without any prior authentication. The attack combines WebSocket-based re…

    SignalK signalk-server signalk-server npm
  • Critical 9.7
    CVE-2025-66398 Public exploit EPSS 20%

    Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

    Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the at…

    SignalK signalk-server signalk-server npm