Executive brief
Signal K Server is a central hub used on boats to manage navigation and sensor data. A security flaw allows unauthorized users to remotely change which data sources (like GPS or AIS) the boat trusts. This could allow an attacker to manipulate critical navigation information, and these changes remain in effect even if the system is restarted.
Technical details
Signal K Server prior to version 2.24.0-beta.1 exposes an unauthenticated HTTP PUT endpoint at `/signalk/v1/api/sourcePriorities`. The vulnerable handler in `src/serverroutes.ts` lacks authentication and authorization middleware, directly assigning the user-controlled request body to the server's `sourcePriorities` configuration. Because the server immediately applies these changes and persists them to the settings file on disk, an attacker can remotely influence which sensor data (GPS, AIS, etc.) is prioritized by the system. This manipulation survives server restarts and requires no valid credentials or user interaction.
Affected products
- SignalK Signal K Server < 2.24.0-beta.1
Timeline
- 2026-03-23: patched: Version 2.24.0-beta.1 tagged on GitHub
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: CVE published to NVD