Is CVE-2026-123807 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123807 being exploited in the wild.

How severe is CVE-2026-123807?

Critical severity, with a CVSS score of 9.8, published 9 November 2026.

Which products and versions are affected?

Signal K @Signalk/Resources-Provider 1.0.0 to 1.5.3; Signal K Server 2.0.0 to 2.34.0.

How is CVE-2026-123807 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-123807?

Check whether you run Signal K @Signalk/Resources-Provider or Signal K Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123807: Signal K Server path traversal in REST resources endpoint

CVE-2026-123807 · Severity: critical · CVSS 9.8 · Published 2026-11-09

Signal K Server is a marine navigation application that manages data on boat hub computers. An attacker can read, write, or delete arbitrary files on the server through an unsafe resources API endpoint, potentially exposing administrator secrets and credentials stored in security.json. With these secrets, an attacker can forge administrator tokens and execute commands with server privileges, leading to complete system compromise.

Technologies: Signal K Server. Vendors: Signal K.

Quick answers

Is CVE-2026-123807 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123807 being exploited in the wild.
How severe is CVE-2026-123807?: Critical severity, with a CVSS score of 9.8, published 9 November 2026.
Which products and versions are affected?: Signal K @Signalk/Resources-Provider 1.0.0 to 1.5.3; Signal K Server 2.0.0 to 2.34.0.
Is there a fix for CVE-2026-123807?: Yes: fixed in Signal K Server 2.34.0; @signalk/resources-provider 1.5.3. Until then: Restrict network access to the Signal K Server REST API endpoints to trusted clients only, or disable the resources endpoint if not required. Deployments should disable allow_readonly mode to require authentication for resource access. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123807 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-123807?: Check whether you run Signal K @Signalk/Resources-Provider or Signal K Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Signal K Server 2.34.0; @signalk/resources-provider 1.5.3

Restrict network access to the Signal K Server REST API endpoints to trusted clients only, or disable the resources endpoint if not required. Deployments should disable allow_readonly mode to require authentication for resource access.

Technical details

The GET/PUT/DELETE /signalk/v2/api/resources endpoint fails to properly validate the resourceId parameter, allowing path traversal attacks that bypass directory containment in FileStore.getResource(). An unauthenticated attacker can read security.json to obtain the HS256 JWT signing secret, forge an admin token, and then leverage the POST /skServer/providers endpoint to create an Execute provider that runs arbitrary commands. The vulnerability affects Signal K Server 2.0.0 through 2.34.0 and @signalk/resources-provider 1.0.0 through 1.5.3.

Affected products

Signal K Signal K Server 2.0.0 to 2.34.0
Signal K @signalk/resources-provider 1.0.0 to 1.5.3

Timeline

2026-11-09: disclosed
2026-10-18: patched: Signal K Server v2.34.0 and @signalk/resources-provider 1.5.3 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.