CVE-2026-35038 in signalk-server
Summary
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, there is an arbitrary prototype read vulnerability via `from` field bypass. This vulnerability allows a low-privileged authenticated user to bypass prototype boundary filtering to extract internal functions and properties from the global prototype object this violates data isolation and lets a user read more than they should. This issue has been patched in version 2.24.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Responsible
GitHub_M
Reservation
03/31/2026
Disclosure
04/02/2026
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 354940 | SignalK signalk-server information disclosure | 200 | Proof-of-Concept | Official fix | CVE-2026-35038 |