signalk-server versions from 2.28.0-beta.2 up to but not including 2.34.0 contain a server-side request forgery (SSRF) vulnerability via the app store icon fetcher. The server fetches absolute URLs declared in a plugin's signalk.appIcon field without proper restrictions, allowing an attacker to cause the server to make HTTP requests to internal or cloud metadata endpoints. Responses with image content types are stored and served back to the admin UI. This can be exploited by publishing a malicious plugin to the app store. A fix is available in version 2.34.0.