Is CVE-2025-68273 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-68273 being exploited in the wild.

How severe is CVE-2025-68273?

Medium severity, with a CVSS score of 5.3, published 1 January 2026.

Which products and versions are affected?

signalk-server (npm) < 2.19.0, SEMVER:introduced=0,fixed=2.19.0.

Is there a fix for CVE-2025-68273?

Yes. signalk-server (npm): upgrade to 2.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-68273 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2025-68273?

Check whether you run signalk-server (npm) or Signalk Signal K Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-68273: Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints

Q: Is there a fix for CVE-2025-68273?

Yes. signalk-server (npm): upgrade to 2.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-68273 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2025-68273?

Check whether you run signalk-server (npm) or Signalk Signal K Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-68273 · Severity: medium · CVSS 5.3 · Published 2026-01-01

Signal K Server is a Node.js-based platform for managing and visualizing maritime vessel data and systems. Several API endpoints that expose sensitive system information—including the complete data schema, connected hardware devices, and installed tools—are accessible without authentication, allowing an attacker to conduct detailed reconnaissance and plan follow-up attacks.

Technologies: signalk-server (npm), Signalk Signal K Server. Vendors: npm, Signalk.

Quick answers

Is CVE-2025-68273 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-68273 being exploited in the wild.
How severe is CVE-2025-68273?: Medium severity, with a CVSS score of 5.3, published 1 January 2026.
Which products and versions are affected?: signalk-server (npm) < 2.19.0, SEMVER:introduced=0,fixed=2.19.0.
Is there a fix for CVE-2025-68273?: Yes. signalk-server (npm): upgrade to 2.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-68273 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2025-68273?: Check whether you run signalk-server (npm) or Signalk Signal K Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

signalk-server (npm): upgrade to 2.19.0 or later
```
npm install signalk-server@2.19.0
```

Technical details

The vulnerability is a missing authentication flaw affecting three API endpoints in Signal K Server versions ≤2.18.0. The endpoints /skServer/serialports, /skServer/availablePaths, and /skServer/hasAnalyzer are defined in src/serverroutes.ts but are not included in the authentication middleware's protected path list in src/tokensecurity.js, allowing unauthenticated network access. An attacker can directly query these endpoints without credentials to retrieve the full vessel data schema (e.g., environment.sun.sunrise, navigation.position), connected serial device information, and system capabilities. The attack requires no authentication, user interaction, or special privileges. A fix is available in version 2.19.0, which adds these endpoints to the authentication protection list.

Affected products

Signal K signalk-server <=2.18.0

Identifiers

CVE-2025-68273
GHSA-fpf5-w967-rr2m

Timeline

2026-01-01: disclosed
2026-01-02: patched: Version 2.19.0 released with fix

References

https://github.com/SignalK/signalk-server/security/advisories/GHSA-fpf5-w967-rr2m

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.