Live › vulnerability › CVE-2026-115752
Go to dashboardSignal K Server versions from 2.28.0-beta.2 before 2.34.0 fetch icon URLs from npm packages without restricting the destination, trusting absolute signalk.appIcon URLs. An attacker who publishes a package with Signal K keywords can make the server request loopback, vessel-network or cloud metadata endpoints and store image responses that are shown back in the admin UI.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Signal K Server between 2.28.0-beta.2 and 2.34.0 that have the App Store icon fetcher active, typically on boat or vessel networks and self-hosted instances where internal endpoints or cloud metadata are reachable from the server. Instances on versions outside that range, or that cannot reach internal services, face lower risk.
No product ranges from the sources yet.
signalk-server --version or the version field in the package.json of the Signal K Server install.2.34.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud metadata endpoints, storing image-typed responses served back via the admin UI.
This page as .md · .json · in your agent: get_signal("CVE-2026-115752")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.