Vulnerability Description
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/SignalK/signalk-server
- https://github.com/SignalK/signalk-server/blob/v2.32.0/src/interfaces/logfiles.j
- https://github.com/SignalK/signalk-server/commit/728bab82742d16c54e50525b95dc9b6
- https://github.com/SignalK/signalk-server/releases/tag/v2.33.0
- https://github.com/SignalK/signalk-server/security/advisories/GHSA-4w32-qx5g-cpw
- https://www.vulncheck.com/advisories/signal-k-server-before-2.33.0-missing-authe
FAQ
What is CVE-2026-118690?
CVE-2026-118690 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can ex...
How severe is CVE-2026-118690?
CVE-2026-118690 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-118690?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.