Executive brief
Signal K Server is a central data hub used on boats to manage navigation and vessel information. A security flaw allows unauthorized individuals to create their own administrator accounts without needing any existing credentials. This could allow an attacker to remotely take control of the boat's server, modify sensitive navigation data, or change critical system configurations.
Technical details
Signal K Server contains a privilege escalation vulnerability due to improper authorization in the /skServer/enableSecurity endpoint. While this endpoint is intended to be used only during initial setup, it remains active and accessible even after security has been enabled and an administrator has been configured. The root cause is twofold: the route is never deregistered after the first use, and the server blindly trusts the 'type' field in the JSON request body. An unauthenticated attacker can send a POST request to this endpoint to inject a new user with 'admin' privileges, gaining full control over the server's configuration and vessel data. This issue is fixed in version 2.24.0-beta.4.
Affected products
- SignalK Signal K Server < 2.24.0-beta.4
Timeline
- 2026-03-25: patched: Version 2.24.0-beta.4 released
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: CVE-2026-33950 published to NVD