Skip to content
OpenAdvisories

Vendor

SignalK

18 known vulnerabilities.

Products

signalk-server 18 resources-provider 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-123807 Public exploit

    Signal K Server: Unauthenticated path traversal in resources-provider v2 API leads to JWT secret disclosure, admin impersonation and remote code execution

    Signal K Server is a server application that runs on a central hub in a boat. From 2.0.0 until 2.34.0 for Signal K Server and from 1.0.0 until 1.5.3 for @signalk/resources-provider, the v2 REST route GET /signalk/v2/api/resources/:resourceType/:resourceId acc…

    SignalK signalk-server resources-provider
  • Critical 9.7
    CVE-2025-66398 Public exploit EPSS 20%

    Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

    Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the at…

    SignalK signalk-server signalk-server npm