SIGNALK-SERVER · GHSA-7m8x-x364-m26j · Package
FIX → 2.31.0-beta.1
Signal K Server lets an unauthenticated WebSocket client subscribe to the log path and receive the server's buffered logs. An attacker who can reach the WebSocket endpoint can read whatever the server has logged.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Signal K Server, typically marine or boat data servers, where the WebSocket endpoint is reachable by clients that have not logged in. Deployments that keep the server behind a trusted network boundary with no untrusted access are less exposed. The sources do not say whether logs contain secrets in default configurations.
Not affected if no-untrusted-network-access, version-2.31.0-beta.1-or-later
Who cares self-hosted, signalk-server, websocket
signalk-server in the project lockfile or with npm ls signalk-server.Upgrade to 2.31.0-beta.1
signalk-server moves to 2.31.0-beta.1 or later.An unauthenticated WebSocket client can subscribe to the log path and receive buffered server logs.
WebSocket connections are intentionally permitted before authentication because login occurs over the WebSocket connection. However, the log subscription path does not enforce an authorization check.
processSubscribe handles subscriptions to the log path separately, without applying access control:
if (
Array.isArray(msg.subscribe) &&
msg.subscribe.length > 0 &&
msg.subscribe[0].path === 'log'
) {
if (!spark.logUnsubscribe) {
spark.logUnsubscribe = startServerLog(app, spark)
}
} else {
// normal subscriptions go through subscriptionmanager, which applies
// securityStrategy.filterReadDelta
}
startServerLog then replays the whole buffer to that socket:
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
app.logging.getLog().forEach((log) => {
spark.write({ type: 'LOG', data: log })
})
The asymmetry is inside this one file. Writes are gated by securityStrategy.shouldAllowWrite (ws.ts:961), normal delta subscriptions are filtered by securityStrategy.filterReadDelta (ws.ts:1159, the else branch of this same function), and the log branch consults neither.
An unauthenticated socket, which is legitimately open for login, can subscribe to log and receive buffered server logs.
Fix: Requires an administrator principal, before startServerLog, in the same way the other branch defers to securityStrategy. The fix was released with version 2.31.0-beta.1.
The investigated code path was reviewed at commit 26ab199. No server was run and no WebSocket frames were captured. AI assistance was used during the investigation.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.