Threat Intelligence Database

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest() in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints without validating the destination. When security was not configured, addAdminMiddleware() was a no-op in dummysecurity.ts, leaving all three endpoints accessible without authentication. The server could be forced to contact loopback, private, link-local, cloud metadata, or arbitrary external destinations, and selfsignedcert could disable certificate verification for outbound HTTPS requests. The checkAccessRequest endpoint also interpolated requestId into its destination path, allowing traversal to other paths on the selected host. Distinct success, connection-refused, and timeout responses enabled internal port scanning; returned response bodies enabled cloud metadata and internal-service data exfiltration; requestAccess enabled server-side POST requests with attacker-controlled JSON; and access to cluster-internal services could support lateral movement. This issue is fixed in version 2.28.0.

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) are protected by express-rate-limit (default: 100 attempts per 10-minute window, configurable via HTTP_RATE_LIMITS). The WebSocket login path — sending {login: {username, password}} messages over an established WebSocket connection — calls app.securityStrategy.login() directly without any rate limiting. An attacker can bypass HTTP rate limiting entirely by opening a WebSocket connection and attempting unlimited password guesses at the speed bcrypt allows (~20 attempts/sec with 10 salt rounds). This issue has been patched in version 2.25.0.

CVE-2026-35038 is a low-severity vulnerability in SignalK Server versions prior to 2.24.0. It involves improper input validation that allows a low-privileged authenticated user to bypass prototype boundary filtering via the 'from' field. This enables the user to read internal functions and properties from the global prototype object, violating data isolation. The vulnerability has been patched in version 2.24.0.

SignalK Server versions prior to 2.24.0 contain a vulnerability in the OIDC login and logout handlers where the HTTP Host header is not validated. This allows an attacker to spoof the Host header to manipulate the OAuth2 redirect_uri, potentially stealing OAuth authorization codes and hijacking user sessions. The issue arises because the redirectUri configuration is unset by default, enabling injection of arbitrary domains. This vulnerability has been patched in version 2.24.0.

SignalK Server versions prior to 2.24.0-beta.1 have an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities without authentication or authorization. This vulnerability enables attackers to control which GPS, AIS, or sensor data sources the system trusts. Changes made via this endpoint are applied immediately and persist across server restarts. The issue has been patched in version 2.24.0-beta.1.

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a privilege escalation vulnerability by Admin Role Injection via /enableSecurity. An unauthenticated attacker can gain full Administrator access to the SignalK server at any time, allowing them to modify sensitive vessel routing data, alter server configurations, and access restricted endpoints. This issue has been patched in version 2.24.0-beta.4.

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId() function blocks forward slashes (/) but not backslashes (\), which are treated as directory separators by path.join() on Windows. This enables attackers to escape the intended applicationData directory. This vulnerability is fixed in 2.20.3.

MediumVulnerabilityNorwayUnited KingdomGermany+4#cve#cve-2026-25228#cwe-22

CVE-2026-23515 is a critical OS command injection vulnerability in SignalK signalk-server versions prior to 1.5.0. It allows authenticated users with write permissions to execute arbitrary shell commands when the set-system-time plugin is enabled. If security is disabled, unauthenticated users can also exploit this flaw. The vulnerability arises from unsafe shell command construction when processing navigation.datetime values received via WebSocket delta messages. This can lead to full system compromise, impacting confidentiality, integrity, and availability. The vulnerability has a CVSS score of 10, indicating maximum severity. No known exploits are currently reported in the wild.

CriticalVulnerabilityNetherlandsGermanyFrance+7#cve#cve-2026-23515#cwe-78

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access request system have two related features that when combined by themselves and with an information disclosure vulnerability enable convincing social engineering attacks against administrators. When a device creates an access request, it specifies three fields: `clientId`, `description`, and `permissions`. The SignalK admin UI displays the `description` field prominently to the administrator when showing pending requests, but the actual `permissions` field (which determines the access level granted) is less visible or displayed separately. This allows an attacker to request `admin` permissions while providing a description that suggests readonly access. The access request handler trusts the `X-Forwarded-For` HTTP header without validation to determine the client's IP address. This header is intended to preserve the original client IP when requests pass through reverse proxies, but when trusted unconditionally, it allows attackers to spoof their IP address. The spoofed IP is displayed to administrators in the access request approval interface, potentially making malicious requests appear to originate from trusted internal network addresses. Since device/source names can be enumerated via the information disclosure vulnerability, an attacker can impersonate a legitimate device or source, craft a convincing description, spoof a trusted internal IP address, and request elevated permissions, creating a highly convincing social engineering scenario that increases the likelihood of administrator approval. Users should upgrade to version 2.19.0 to fix this issue.

MediumVulnerabilityNorwayUnited KingdomNetherlands+7#cve#cve-2025-69203#cwe-290

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. While the endpoint validates that the package name exists in the npm registry as a known plugin or webapp, the version parameter accepts arbitrary npm version specifiers including URLs.npm supports installing packages from git repositories, GitHub shorthand syntax, and HTTP/HTTPS URLs pointing to tarballs. When npm installs a package, it can automatically execute any `postinstall` script defined in `package.json`, enabling arbitrary code execution. The vulnerability exists because npm's version specifier syntax is extremely flexible, and the SignalK code passes the version parameter directly to npm without sanitization. An attacker with admin access can install a package from an attacker-controlled source containing a malicious `postinstall` script. Version 2.19.0 contains a patch for the issue.

HighVulnerabilityNorwayUnited KingdomGermany+4#cve#cve-2025-68619#cwe-94