{"id":"GHSA-7m8x-x364-m26j","kind":"vulnerability","aliases":["GHSA-7m8x-x364-m26j"],"related":[],"title":"Signal K Server: Buffered logs exposed to unauthenticated WebSocket clients","description":"### Summary\n\nAn unauthenticated WebSocket client can subscribe to the log path and receive buffered server logs.\n\nWebSocket connections are intentionally permitted before authentication because login occurs over the WebSocket connection. However, the log subscription path does not enforce an authorization check.\n\n`processSubscribe` handles subscriptions to the log path separately, without applying access control:\n\n```ts\nif (\n  Array.isArray(msg.subscribe) &&\n  msg.subscribe.length > 0 &&\n  msg.subscribe[0].path === 'log'\n) {\n  if (!spark.logUnsubscribe) {\n    spark.logUnsubscribe = startServerLog(app, spark)\n  }\n} else {\n  // normal subscriptions go through subscriptionmanager, which applies\n  // securityStrategy.filterReadDelta\n}\n```\n\n`startServerLog` then replays the whole buffer to that socket:\n\n```ts\napp.logging.getLog().forEach((log) => {\n  spark.write({ type: 'LOG', data: log })\n})\n```\n\nThe asymmetry is inside this one file. Writes are gated by `securityStrategy.shouldAllowWrite` (`ws.ts:961`), normal delta subscriptions are filtered by `securityStrategy.filterReadDelta` (`ws.ts:1159`, the else branch of this same function), and the log branch consults neither.\n\nAn unauthenticated socket, which is legitimately open for login, can subscribe to `log` and receive buffered server logs.\n\nFix: Requires an administrator principal, before `startServerLog`, in the same way the other branch defers to `securityStrategy`. The fix was released with version 2.31.0-beta.1.\n\nThe investigated code path was reviewed at commit 26ab199. No server was run and no WebSocket frames were captured. AI assistance was used during the investigation.","summary":"Signal K Server lets an unauthenticated WebSocket client subscribe to the log path and receive the server's buffered logs. An attacker who can reach the WebSocket endpoint can read whatever the server has logged.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"signalk-server","fixed":["2.31.0-beta.1"],"affected":"< 2.31.0-beta.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-306","package","self-hosted","signalk-server","websocket"],"not_affected_if":["no-untrusted-network-access","version-2.31.0-beta.1-or-later"],"how_to_check":"- Check the installed version of `signalk-server` in the project lockfile or with `npm ls signalk-server`.\n- Confirm the server is reachable from networks an unauthenticated user can reach, such as the internet or an untrusted LAN.","fix":"- `signalk-server` moves to `2.31.0-beta.1` or later.","status":"open","published_at":"2026-11-12T19:14:00+00:00","first_seen_at":"2026-11-12T19:16:32+00:00","triaged_at":"2026-11-12T19:17:49+00:00","updated_at":"2026-11-12T19:17:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-12T19:17:49Z","model":"claude-haiku-5-5","output":{"fix":"- `signalk-server` moves to `2.31.0-beta.1` or later.","reach":"network","title":"Signal K Server: unauthenticated WebSocket clients can read buffered server logs","impact":"low","summary":"Signal K Server lets an unauthenticated WebSocket client subscribe to the log path and receive the server's buffered logs. An attacker who can reach the WebSocket endpoint can read whatever the server has logged.","audience":"businesses","category":"package","nicknames":[],"who_cares":["signalk-server","self-hosted","websocket"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated clients read buffered server logs","analyst_note":"","how_to_check":"- Check the installed version of `signalk-server` in the project lockfile or with `npm ls signalk-server`.\n- Confirm the server is reachable from networks an unauthenticated user can reach, such as the internet or an untrusted LAN.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-2.31.0-beta.1-or-later","no-untrusted-network-access"],"who_is_affected":"Teams running Signal K Server, typically marine or boat data servers, where the WebSocket endpoint is reachable by clients that have not logged in. Deployments that keep the server behind a trusted network boundary with no untrusted access are less exposed. The sources do not say whether logs contain secrets in default configurations.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000797,"input_tokens":5187,"output_tokens":557,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-306':25B '0':127C,129C '2.31.0':240C '26ab199':250C '7m8x':13A,18A 'access':120C 'administr':220C 'ai':261C 'app':136C 'app.logging.getlog':157C 'appli':119C,145C 'array.isarray':124C 'assist':262C 'asymmetri':166C 'attack':55B 'authent':91C 'author':108C 'beta.1':241C 'branch':188C,196C,230C 'buffer':4A,52B,82C,152C,214C 'captur':260C 'check':109C 'client':10A,41B,73C 'code':244C 'commit':249C 'connect':86C,98C 'consult':197C 'control':121C 'cwe':24B 'data':163C 'defer':231C 'delta':179C 'els':138C,187C 'endpoint':61B 'enforc':106C 'expos':6A 'file':171C 'filter':182C 'fix':217C,235C 'foreach':158C 'frame':258C 'function':192C 'gate':174C 'ghsa':12A,17A 'ghsa-7m8x-x364-m26j':11A,16A 'go':141C 'handl':111C 'host':29B 'howev':99C 'insid':168C 'intent':88C 'investig':243C,267C 'k':2A,35B 'legitim':204C 'let':37B 'log':5A,45B,53B,68B,78C,84C,101C,115C,131C,159C,162C,164C,195C,211C,216C 'login':93C,207C 'm26j':15A,20A 'msg.subscribe':125C,128C 'msg.subscribe.length':126C 'neither':198C 'normal':139C,178C 'occur':94C 'one':170C 'open':205C 'packag':26B 'path':46B,79C,103C,116C,130C,245C 'permit':89C 'princip':221C 'processsubscrib':110C 'reach':58B 'read':63B 'receiv':48B,81C,213C 'releas':237C 'replay':149C 'requir':218C 'review':247C 'run':254C 'securitystrategi':233C 'securitystrategy.filterreaddelta':146C,184C 'securitystrategy.shouldallowwrite':176C 'self':28B 'self-host':27B 'separ':117C 'server':3A,23A,32B,36B,50B,66B,83C,215C,252C 'signal':1A,34B 'signalk':22A,31B 'signalk-serv':30B 'signalk-server':21A 'socket':155C,201C 'spark':137C 'spark.logunsubscribe':133C,134C 'spark.write':160C 'startserverlog':135C,147C,223C 'subscrib':42B,75C,209C 'subscript':102C,112C,140C,180C 'subscriptionmanag':143C 'summari':69C 'ts':122C,156C 'type':161C 'unauthent':8A,39B,71C,200C 'use':264C 'version':239C 'way':227C 'websocket':9A,33B,40B,60B,72C,85C,97C,257C 'whatev':64B 'whole':151C 'without':118C 'write':172C 'ws.ts:1159':185C 'ws.ts:961':177C 'x364':14A,19A","nicknames":[],"mitigations":[],"who_affected":"Teams running Signal K Server, typically marine or boat data servers, where the WebSocket endpoint is reachable by clients that have not logged in. Deployments that keep the server behind a trusted network boundary with no untrusted access are less exposed. The sources do not say whether logs contain secrets in default configurations.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["signalkserver"],"ptokens":["server","signalk"],"labels":["cwe306","medium","npm","package","selfhosted","signalkserver","websocket"],"campaign_type":null,"search_a":"'7m8x':13A,18A 'buffer':4A 'client':10A 'expos':6A 'ghsa':12A,17A 'ghsa-7m8x-x364-m26j':11A,16A 'k':2A 'log':5A 'm26j':15A,20A 'server':3A,23A 'signal':1A 'signalk':22A 'signalk-server':21A 'unauthent':8A 'websocket':9A 'x364':14A,19A","search_b":"'-306':25B 'attack':55B 'buffer':52B 'client':41B 'cwe':24B 'endpoint':61B 'host':29B 'k':35B 'let':37B 'log':45B,53B,68B 'packag':26B 'path':46B 'reach':58B 'read':63B 'receiv':48B 'self':28B 'self-host':27B 'server':32B,36B,50B,66B 'signal':34B 'signalk':31B 'signalk-serv':30B 'subscrib':42B 'unauthent':39B 'websocket':33B,40B,60B 'whatev':64B","search_c":"'0':127C,129C '2.31.0':240C '26ab199':250C 'access':120C 'administr':220C 'ai':261C 'app':136C 'app.logging.getlog':157C 'appli':119C,145C 'array.isarray':124C 'assist':262C 'asymmetri':166C 'authent':91C 'author':108C 'beta.1':241C 'branch':188C,196C,230C 'buffer':82C,152C,214C 'captur':260C 'check':109C 'client':73C 'code':244C 'commit':249C 'connect':86C,98C 'consult':197C 'control':121C 'data':163C 'defer':231C 'delta':179C 'els':138C,187C 'enforc':106C 'file':171C 'filter':182C 'fix':217C,235C 'foreach':158C 'frame':258C 'function':192C 'gate':174C 'go':141C 'handl':111C 'howev':99C 'insid':168C 'intent':88C 'investig':243C,267C 'legitim':204C 'log':78C,84C,101C,115C,131C,159C,162C,164C,195C,211C,216C 'login':93C,207C 'msg.subscribe':125C,128C 'msg.subscribe.length':126C 'neither':198C 'normal':139C,178C 'occur':94C 'one':170C 'open':205C 'path':79C,103C,116C,130C,245C 'permit':89C 'princip':221C 'processsubscrib':110C 'receiv':81C,213C 'releas':237C 'replay':149C 'requir':218C 'review':247C 'run':254C 'securitystrategi':233C 'securitystrategy.filterreaddelta':146C,184C 'securitystrategy.shouldallowwrite':176C 'separ':117C 'server':83C,215C,252C 'socket':155C,201C 'spark':137C 'spark.logunsubscribe':133C,134C 'spark.write':160C 'startserverlog':135C,147C,223C 'subscrib':75C,209C 'subscript':102C,112C,140C,180C 'subscriptionmanag':143C 'summari':69C 'ts':122C,156C 'type':161C 'unauthent':71C,200C 'use':264C 'version':239C 'way':227C 'websocket':72C,85C,97C,257C 'whole':151C 'without':118C 'write':172C 'ws.ts:1159':185C 'ws.ts:961':177C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T19:14:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-7m8x-x364-m26j","url":"https://github.com/advisories/GHSA-7m8x-x364-m26j","severity":"medium","published_at":"2026-11-12T19:14:00+00:00","modified_at":"2026-11-12T19:14:01+00:00","first_seen_at":"2026-11-12T19:16:32+00:00","fetched_at":"2026-11-12T19:36:50+00:00","note":null}],"documents":[{"id":137728,"url":"https://api.github.com/repos/SignalK/signalk-server/security-advisories/GHSA-7m8x-x364-m26j","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":137729,"url":"https://github.com/SignalK/signalk-server/security/advisories/GHSA-7m8x-x364-m26j","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":137730,"url":"https://github.com/SignalK/signalk-server/commit/1bee85114a4cb7403aba71632d9902792d6b4f0c","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":137731,"url":"https://github.com/SignalK/signalk-server/releases/tag/v2.31.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":137732,"url":"https://github.com/SignalK/signalk-server/releases/tag/v2.31.0-beta.1","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}