---
id: "GHSA-7m8x-x364-m26j"
page: "https://infrastack.ai/live/GHSA-7m8x-x364-m26j"
kind: "vulnerability"
aliases: ["GHSA-7m8x-x364-m26j"]
title: "Signal K Server: Buffered logs exposed to unauthenticated WebSocket clients"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "signalk-server", "fixed": ["2.31.0-beta.1"], "affected": "< 2.31.0-beta.1", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-306", "package", "self-hosted", "signalk-server", "websocket"]
not_affected_if: ["no-untrusted-network-access", "version-2.31.0-beta.1-or-later"]
published_at: "2026-11-12T19:14:00+00:00"
first_seen_at: "2026-11-12T19:16:32+00:00"
updated_at: "2026-11-12T19:17:49+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-7m8x-x364-m26j", "first_seen_at": "2026-11-12T19:16:32+00:00"}]
exploit_sources: []
---

# Signal K Server: Buffered logs exposed to unauthenticated WebSocket clients

Link for people: https://infrastack.ai/live/GHSA-7m8x-x364-m26j (this .md is for agents)

Signal K Server lets an unauthenticated WebSocket client subscribe to the log path and receive the server's buffered logs. An attacker who can reach the WebSocket endpoint can read whatever the server has logged.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:signalk-server affected < 2.31.0-beta.1 fixed 2.31.0-beta.1

## How to check

- Check the installed version of `signalk-server` in the project lockfile or with `npm ls signalk-server`.
- Confirm the server is reachable from networks an unauthenticated user can reach, such as the internet or an untrusted LAN.

## Fix

- `signalk-server` moves to `2.31.0-beta.1` or later.

## Timeline

- 2026-11-12T19:16:32+00:00 ghsa https://github.com/advisories/GHSA-7m8x-x364-m26j

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/SignalK/signalk-server/security-advisories/GHSA-7m8x-x364-m26j
- [advisory] Maintainer's advisory: github.com https://github.com/SignalK/signalk-server/security/advisories/GHSA-7m8x-x364-m26j
- [fix] Patch: github.com https://github.com/SignalK/signalk-server/commit/1bee85114a4cb7403aba71632d9902792d6b4f0c
- [fix] Release: github.com https://github.com/SignalK/signalk-server/releases/tag/v2.31.0
- [fix] Release: github.com https://github.com/SignalK/signalk-server/releases/tag/v2.31.0-beta.1

## From the sources

### Summary

An unauthenticated WebSocket client can subscribe to the log path and receive buffered server logs.

WebSocket connections are intentionally permitted before authentication because login occurs over the WebSocket connection. However, the log subscription path does not enforce an authorization check.

`processSubscribe` handles subscriptions to the log path separately, without applying access control:

```ts
if (
  Array.isArray(msg.subscribe) &&
  msg.subscribe.length > 0 &&
  msg.subscribe[0].path === 'log'
) {
  if (!spark.logUnsubscribe) {
    spark.logUnsubscribe = startServerLog(app, spark)
  }
} else {
  // normal subscriptions go through subscriptionmanager, which applies
  // securityStrategy.filterReadDelta
}
```

`startServerLog` then replays the whole buffer to that socket:

```ts
app.logging.getLog().forEach((log) => {
  spark.write({ type: 'LOG', data: log })
})
```

The asymmetry is inside this one file. Writes are gated by `securityStrategy.shouldAllowWrite` (`ws.ts:961`), normal delta subscriptions are filtered by `securityStrategy.filterReadDelta` (`ws.ts:1159`, the else branch of this same function), and the log branch consults neither.

An unauthenticated socket, which is legitimately open for login, can subscribe to `log` and receive buffered server logs.

Fix: Requires an administrator principal, before `startServerLog`, in the same way the other branch defers to `securityStrategy`. The fix was released with version 2.31.0-beta.1.

The investigated code path was reviewed at commit 26ab199. No server was run and no WebSocket frames were captured. AI assistance was used during the investigation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_