CVE-2026-118690
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows…
- Risk score
- 64/100
- CVSS
- 9.8 v3.1
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Signal K Server before 2.33.0 has a missing authentication vulnerability. An attacker can download log archives, extract the JWT secret key, forge administrator tokens, and create persistent admin accounts for full server control.
- Affected
- {'products': ['Signal K Server'], 'packages': [], 'versions': ['before 2.33.0']}
- Fix
- Upgrade to version 2.33.0 or later
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
- https://github.com/SignalK/signalk-server
- https://github.com/SignalK/signalk-server/blob/v2.32.0/src/interfaces/logfiles.js#L30-L91
- https://github.com/SignalK/signalk-server/commit/728bab82742d16c54e50525b95dc9b6e32396107
- https://github.com/SignalK/signalk-server/releases/tag/v2.33.0
- https://github.com/SignalK/signalk-server/security/advisories/GHSA-4w32-qx5g-cpwv
- https://www.vulncheck.com/advisories/signal-k-server-before-2.33.0-missing-authentication-via-skserver-ziplogs
Original description
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.
Last activity 28 Oct 2026. Patch Forecast updates every hour.