CVE-2026-55591
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Signal K Server prior to 2.28.0 has a vulnerability in makeRemoteRequest() that accepts attacker-controlled host, port, useTLS, and selfsignedcert parameters without validating the destination. When security is not configured, the endpoints testSignalKConnection, requestAccess, and checkAccessRequest are accessible without authentication, allowing port scanning, exfiltration of cloud metadata and internal service data, and lateral movement.
Risk Assessment
The organization may experience data leakage from internal services, port scanning, and potential lateral movement in the infrastructure, potentially leading to full system compromise.
Recommendation
Upgrade Signal K Server to version 2.28.0 or later and configure authentication and validate outbound parameters.
Other vulnerabilities in Signal K Server
See all- CVE-2025-68619High
Signal K Server prior to version 2.19.0 allows administrators to install npm packages via a REST API endpoint. The version parameter accepts arbitrary npm version specifiers including URLs, enabling arbitrary code execution via postinstall scripts. Version 2.19.0 contains a patch.
- CVE-2025-68272High
Signal K Server prior to version 2.19.0 has a DoS vulnerability that allows an unauthenticated attacker to flood the /signalk/v1/access/requests endpoint, causing a 'JavaScript heap out of memory' error and crashing the server. Version 2.19.0 fixes the issue.
- CVE-2026-33950Critical
Signal K Server before version 2.24.0-beta.4 has a privilege escalation vulnerability via admin role injection in the /enableSecurity endpoint. An unauthenticated attacker can gain full administrative access.
- CVE-2025-68620Critical
Signal K Server before version 2.19.0 allows an unauthenticated attacker to chain two features to steal JWT tokens: unauthenticated WebSocket request enumeration and unauthenticated polling of access request status.
- CVE-2025-66398Critical
Signal K Server before version 2.19.0 allows an unauthenticated attacker to pollute the internal state (restoreFilePath) via the /skServer/validateBackup endpoint, enabling hijacking of the administrator's Restore functionality to overwrite critical configuration files, leading to account takeover and RCE.
- CVE-2026-41893High
Signal K Server prior to version 2.25.0 protects HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) with express-rate-limit (default: 100 attempts per 10-minute window). However, the WebSocket login path — sending {login: {username, password}} messages over an established WebSocket connection — calls app.securityStrategy.login() directly without any rate limiting. An attacker can bypass HTTP rate limiting entirely by opening a WebSocket connection and attempting unlimited password guesses at the speed bcrypt allows (~20 attempts/sec with 10 salt rounds). This issue has been fixed in version 2.25.0.
- CVE-2026-35038Medium
Signal K Server before version 2.24.0 has a prototype read vulnerability via `from` field bypass. A low-privileged authenticated user can bypass prototype boundary filtering to read internal functions and properties from the global prototype object.
- CVE-2026-34083Medium
Signal K Server before version 2.24.0 has a vulnerability in OIDC login/logout handlers where the unvalidated Host header is used to construct the OAuth2 redirect_uri. Since redirectUri is unset by default, an attacker can spoof the Host header to steal OAuth authorization codes and hijack user sessions.
- CVE-2026-33951High
Signal K Server before version 2.24.0-beta.1 exposes an unauthenticated HTTP endpoint PUT /signalk/v1/api/sourcePriorities that allows remote attackers to modify navigation data source priorities. Changes are applied immediately and persisted.
Original NVD description (English source)
Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest() in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints without validating the destination. When security was not configured, addAdminMiddleware() was a no-op in dummysecurity.ts, leaving all three endpoints accessible without authentication. The server could be forced to contact loopback, private, link-local, cloud metadata, or arbitrary external destinations, and selfsignedcert could disable certificate verification for outbound HTTPS requests. The checkAccessRequest endpoint also interpolated requestId into its destination path, allowing traversal to other paths on the selected host. Distinct success, connection-refused, and timeout responses enabled internal port scanning; returned response bodies enabled cloud metadata and internal-service data exfiltration; requestAccess enabled server-side POST requests with attacker-controlled JSON; and access to cluster-internal services could support lateral movement. This issue is fixed in version 2.28.0.