CVE-2026-118690
SignalK signalk-server
- SignalK signalk-server
- Critical
- CVSS 9.3
- Fixed version listed
Summary
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint.
From the CVE record.
Read the original description
CVE record
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.
What to do
Fixed version listed
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| SignalK signalk-server | before 2.33.0 | 2.33.0 |
Advisories and fixes
- Vendor advisory github.com
- Patch github.com
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.3 (v4.0, scored by VulnCheck)
- Weakness
- CWE-306: Missing Authentication for Critical Function
- Vendor
- SignalK, signalk-server
Timeline
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.