{"schema":"threatline.record/2","record":{"id":"CVE-2026-118690","aliases":["GHSA-4w32-qx5g-cpwv"],"summary":"Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs","details":"Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.","categories":["Unclassified"],"product":"signalk-server","vendor":"SignalK","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-118690","source_modified_at":"2026-10-28T21:11:17.919Z","fetched_at":"2026-10-29T00:48:09.584895Z","product":"signalk-server","vendor":"SignalK","versions":[{"version":"0","status":"affected","versionType":"semver","lessThan":"2.33.0"},{"version":"2.33.0","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-118690","source_modified_at":"2026-10-28T21:11:17.919Z","fetched_at":"2026-10-29T00:48:09.584895Z","package":{"name":"signalk-server","ecosystem":null},"version":"2.33.0","basis":"first unaffected version stated in the CVE record"}],"cvss":9.3,"severity":"Critical","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T21:11:17.919Z","modified_at":"2026-10-28T21:11:17.919Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-118690","fetched_at":"2026-10-29T00:48:09.584895Z","source_modified_at":"2026-10-28T21:11:17.919Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/SignalK/signalk-server/commit/728bab82742d16c54e50525b95dc9b6e32396107","tags":["patch"]},{"source":"CVE List","url":"https://github.com/SignalK/signalk-server","tags":["product"]},{"source":"CVE List","url":"https://github.com/SignalK/signalk-server/security/advisories/GHSA-4w32-qx5g-cpwv","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://github.com/SignalK/signalk-server/blob/v2.32.0/src/interfaces/logfiles.js#L30-L91","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/SignalK/signalk-server/releases/tag/v2.33.0","tags":["release-notes"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/signal-k-server-before-2.33.0-missing-authentication-via-skserver-ziplogs","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T21:11:17.919Z","content_hash":"2a8433881f2315c333136f41fafd7fa2bdbdf2b574ae24c1185ec5161c471d6d"}}