Live › vulnerability › CVE-2026-118690
Go to dashboardSignal K Server before 2.33.0 serves log archives from its /skServer/ziplogs endpoint without requiring authentication. The archive contains the JWT secret key from security.json, which lets an attacker forge administrator tokens and create persistent admin accounts for full server control.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 22:35 UTC. All times on this page are UTC.
Any Signal K Server instance older than 2.33.0 that is reachable over a network the attacker can reach, since the ziplogs endpoint needs no login. Instances behind a firewall or limited to a trusted local network have a smaller exposure, but the endpoint should still be patched.
No product ranges from the sources yet.
npm ls signalk-server or check the installed Signal K Server version against 2.33.0./skServer/ziplogs without credentials on the server and see whether a ZIP file is returned.2.33.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.
This page as .md · .json · in your agent: get_signal("CVE-2026-118690")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.