CVE-2026-118690GHSA-4w32-qx5g-cpwv
signalk-server: Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs
SignalK signalk-server
CVSS
9.3CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 2.33.0signalk-serverCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Reports 2
1 outlet mention it. Reports are not confirmation; each links to its source.
- @stemshop.bsky.social: 🚨 CVE-2026-118690 — CVSS 9.3 CRITICAL Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated r... 🔎 https://stemshop.top/cve/CVE-Bluesky: CVE posts, 29 Oct 2026
- @stackflag.bsky.social: CVE-2026-118690 - signalk-server The Signal K Server (versions before 2.33.0) lets anyone on the network pull a compressed file of its logs without proving who they are. Inside thaBluesky: CVE posts, 28 Oct 2026
Description
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.
Text from CVE List
Affected versions 2
- signalk-serveraffected: all versions before 2.33.0CVE List
- signalk-serverunaffected: 2.33.0CVE List
References 6
- github.com/SignalK/signalk-server/commit/728bab82742d16c54e50525b95dc9b6e32396107Fixvia CVE List
- github.com/SignalK/signalk-server/releases/tag/v2.33.0Fixvia CVE List
- github.com/SignalK/signalk-server/security/advisories/GHSA-4w32-qx5g-cpwvAdvisoryvia CVE List
- vulncheck.com/advisories/signal-k-server-before-2.33.0-missing-authentication-via-skserver-ziplogsAdvisoryvia CVE List
- github.com/SignalK/signalk-serverReferencevia CVE List
- github.com/SignalK/signalk-server/blob/v2.32.0/src/interfaces/logfiles.js#L30-L91Referencevia CVE List