---
id: "CVE-2026-118690"
kind: "vulnerability"
aliases: ["CVE-2026-118690"]
title: "Signal K Server: unauthenticated log download leaks keys, enabling full admin takeover"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["iot", "marine", "node.js", "package", "self-hosted", "signal-k"]
not_affected_if: ["no-network-exposure", "version-2.33.0-or-later"]
published_at: "2026-10-28T22:17:13+00:00"
first_seen_at: "2026-10-28T22:35:34+00:00"
updated_at: "2026-10-28T22:36:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118690", "first_seen_at": "2026-10-28T22:35:34+00:00"}]
---

# Signal K Server: unauthenticated log download leaks keys, enabling full admin takeover

Signal K Server before 2.33.0 serves log archives from its /skServer/ziplogs endpoint without requiring authentication. The archive contains the JWT secret key from security.json, which lets an attacker forge administrator tokens and create persistent admin accounts for full server control.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `npm ls signalk-server` or check the installed Signal K Server version against `2.33.0`.
- Request `/skServer/ziplogs` without credentials on the server and see whether a ZIP file is returned.

## Fix

- Upgrade Signal K Server to `2.33.0` or later.
- After upgrading, rotate the JWT secret key and review admin accounts for ones you did not create.

## Timeline

- 2026-10-28T22:35:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118690

## From the sources

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_