Executive brief
Signal K Server is a Node.js-based platform for managing and visualizing maritime vessel data and systems. Several API endpoints that expose sensitive system information—including the complete data schema, connected hardware devices, and installed tools—are accessible without authentication, allowing an attacker to conduct detailed reconnaissance and plan follow-up attacks.
Technical details
The vulnerability is a missing authentication flaw affecting three API endpoints in Signal K Server versions ≤2.18.0. The endpoints /skServer/serialports, /skServer/availablePaths, and /skServer/hasAnalyzer are defined in src/serverroutes.ts but are not included in the authentication middleware's protected path list in src/tokensecurity.js, allowing unauthenticated network access. An attacker can directly query these endpoints without credentials to retrieve the full vessel data schema (e.g., environment.sun.sunrise, navigation.position), connected serial device information, and system capabilities. The attack requires no authentication, user interaction, or special privileges. A fix is available in version 2.19.0, which adds these endpoints to the authentication protection list.
Affected products
- Signal K signalk-server <=2.18.0
Timeline
- 2026-01-01: disclosed
- 2026-01-02: patched: Version 2.19.0 released with fix