CVE-2026-115752 in signalk-server
Summary
by MITRE • 10/23/2026
Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud metadata endpoints, storing image-typed responses served back via the admin UI.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The identified vulnerability resides within the Signal K Server software suite, specifically affecting versions ranging from 2.28.0-beta.2 up to but not including version 2.34.0. This security flaw is classified as a server-side request forgery, commonly referred to by its acronym SSRF. The root cause of this vulnerability lies in the application's handling of icon URLs provided through the App Store integration mechanism. Specifically, the system fails to adequately validate or sanitize absolute signalk.appIcon URLs before processing them. By trusting these absolute paths without sufficient restriction on the target host or protocol, the server inadvertently allows an attacker to dictate which internal resources are accessed during the image fetching process.
The operational mechanics of this exploit rely on the ability of attackers to publish npm packages that contain specific Signal K keywords. When a user installs such a package into their Signal K environment, the application attempts to fetch and display icons associated with those applications. Because the server trusts absolute URLs provided in these metadata fields, an attacker can craft a malicious npm package where the icon URL points not to an external legitimate image host, but rather to internal network addresses or cloud provider metadata endpoints. This capability effectively turns the Signal K Server into a proxy that can be directed by an adversary to make requests on behalf of the server itself.
The impact of this vulnerability is significant due to the potential for data exfiltration and reconnaissance within private networks. By directing the SSRF request toward loopback addresses, such as 127.0.0.1 or localhost, attackers can access services running locally on the same host that are not exposed to the public internet. Furthermore, targeting vessel network endpoints allows adversaries to interact with other devices connected to the boat's local area network, potentially exposing sensitive operational data from navigation systems, engine monitors, or communication equipment. Additionally, accessing cloud metadata endpoints is particularly dangerous as these services often contain authentication tokens and configuration details that can be used for further compromise of cloud infrastructure associated with the vessel management system.
This vulnerability aligns closely with Common Weakness Enumeration identifier CWE-918, which describes Server-Side Request Forgery (SSRF) flaws where a web server fetches a remote resource without validating the user-supplied URL. In terms of offensive security frameworks, this behavior maps to MITRE ATT&CK technique T1557, specifically Adversary-in-the-Middle or Lateral Tool Transfer variants that utilize SSRF for network reconnaissance and credential theft. The ability to store image-typed responses served back via the admin UI further exacerbates the risk by providing a persistent channel through which exfiltrated data can be viewed by administrators who may not realize they are viewing attacker-controlled content rather than legitimate application icons.
Mitigation strategies must focus on strict input validation and network-level controls. The most effective immediate remedy is to upgrade Signal K Server to version 2.34.0 or later, where this trust issue has been addressed through improved URL sanitization logic that restricts allowed protocols and blocks access to private IP ranges. For environments unable to update immediately, implementing a web application firewall rule set can help detect and block SSRF attempts targeting internal subnets. Additionally, network segmentation should be enforced to ensure that critical vessel systems are isolated from the general-purpose computing environment running Signal K Server. Administrators should also audit installed npm packages for any suspicious icon URL configurations until patches are applied, ensuring that only trusted sources contribute metadata to the application ecosystem.