CVE-2026-118690 in Signal K Server
Summary
by MITRE • 10/28/2026
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The Signal K Server software prior to version 2.33.0 suffers from a critical missing authentication vulnerability that exposes sensitive administrative functions to unauthenticated remote attackers. This flaw specifically affects the /skServer/ziplogs endpoint, which is designed to generate and serve compressed log archives for diagnostic purposes. However, due to insufficient access control checks on this specific route, any user or automated script can request these logs without providing valid credentials. The vulnerability stems from a failure in the server's middleware layer to verify authentication tokens before processing requests directed at administrative endpoints that handle sensitive file operations. This oversight allows external actors to bypass security controls entirely, treating an admin-only function as public-facing serviceable resource.
The operational impact of this vulnerability is severe because it facilitates a multi-stage attack chain leading to complete system compromise. Once the attacker accesses the /skServer/ziplogs endpoint, they can download the generated ZIP archive which contains server log files and potentially other configuration artifacts stored within the application's data directory. Among these extracted files is security.json, a critical configuration file that stores cryptographic secrets used for session management. Specifically, this file often contains the JWT secretKey required to sign and verify JSON Web Tokens. By extracting this key from the downloaded archive, an attacker gains the ability to forge valid administrator tokens with arbitrary claims, effectively impersonating any user within the system regardless of their actual permissions or password strength.
With forged administrative tokens in hand, the threat actor can proceed to escalate privileges further by creating new persistent admin accounts directly through the API. This step ensures long-term access even if existing credentials are rotated or revoked. The creation of these backdoor accounts allows for full server control, enabling the attacker to modify navigation data, alter system configurations, and potentially exfiltrate additional sensitive information stored on the vessel's networked systems. In maritime contexts where Signal K is commonly deployed, such a compromise could lead to manipulation of navigational displays, interference with sensor data integrity, or use of the compromised server as a pivot point for lateral movement into other critical shipboard networks.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-359 Exposure of Private Key Information within Configuration Files. The attack vector is consistent with MITRE ATT&CK technique T1078 Valid Accounts, specifically the sub-technique for forged credentials, as well as T1552 Unsecured Credentials where sensitive authentication data is stored in a location accessible to unauthorized users. To mitigate this risk, organizations must immediately upgrade Signal K Server to version 2.33.0 or later which addresses these access control deficiencies. Additionally, administrators should audit their deployment configurations to ensure that no other endpoints expose private keys or configuration files containing secrets. Implementing strict input validation and ensuring all administrative routes require valid authentication tokens before processing is essential for maintaining the integrity of maritime IT infrastructure.