What’s Vulnerable › Vulnerabilities
CVE-2026-118690: Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-28 · updated 2026-10-29
- Weakness: CWE-306
Description
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.
Summary
Signal K Server before 2.33.0 exposes the /skServer/ziplogs endpoint without authentication, letting unauthenticated remote attackers download log archives. The ZIP can contain security.json, from which attackers extract the JWT secretKey, forge administrator tokens, and create persistent admin accounts for full server control. Rated CVSS 9.8 critical; it is not listed in CISA KEV, so no confirmed in-the-wild exploitation is reported. Upgrade to 2.33.0 or later, and if upgrading is not immediately possible, restrict access to /skServer/ziplogs and rotate the JWT secretKey if exposure is suspected.
يحتوي Signal K Server قبل الإصدار 2.33.0 على ثغرة انعدام مصادقة في نقطة النهاية /skServer/ziplogs تتيح للمهاجمين عن بُعد وغير المصادَق عليهم تنزيل أرشيفات السجلات. قد يتضمن ملف ZIP ملف security.json الذي يستخرج منه المهاجمون secretKey الخاص بـ JWT، ثم يزوّرون رموز مدير وينشئون حسابات مدير دائمة للسيطرة الكاملة على الخادم. صُنّفت الثغرة بدرجة 9.8 (حرجة)، وهي غير مدرجة في CISA KEV، لذا لا يوجد تأكيد لاستغلالها فعليًا. يجب الترقية إلى الإصدار 2.33.0 أو أحدث، وإذا تعذّرت الترقية الفورية فيُنصح بتقييد الوصول إلى /skServer/ziplogs وتدوير secretKey الخاص بـ JWT عند الاشتباه في تعرّضه.
Affected products
- signalk-server: before 2.33.0 — fixed in 2.33.0
How to fix
Upgrade to a fixed version: signalk-server 2.33.0. Check the vendor advisory for mitigations.
References
- https://github.com/SignalK/signalk-server
- https://github.com/SignalK/signalk-server/blob/v2.32.0/src/interfaces/logfiles.js#L30-L91
- https://github.com/SignalK/signalk-server/commit/728bab82742d16c54e50525b95dc9b6e32396107
- https://github.com/SignalK/signalk-server/releases/tag/v2.33.0
- https://github.com/SignalK/signalk-server/security/advisories/GHSA-4w32-qx5g-cpwv
- https://www.vulncheck.com/advisories/signal-k-server-before-2.33.0-missing-authentication-via-skserver-ziplogs
Get alerted when CVE-2026-118690 or the next vulnerability affects your stack