Executive brief
Signal K Server is an open-source data server for marine use. In versions up to 2.27.0, a security flaw allows unauthenticated users to force the server to make network requests to internal or external destinations. This can be used to scan private networks, access sensitive cloud metadata (like AWS credentials), or bypass security controls on internal services.
Technical details
A Server-Side Request Forgery (SSRF) exists in the `makeRemoteRequest()` function within `src/serverroutes.ts`. The function fails to validate the `host`, `port`, and `path` parameters, allowing requests to loopback addresses, RFC 1918 private ranges, and cloud metadata services (169.254.169.254). Furthermore, when security is not explicitly configured, the `addAdminMiddleware` defaults to a no-op, making the `testSignalKConnection`, `requestAccess`, and `checkAccessRequest` endpoints accessible without authentication. Attackers can also bypass TLS verification via the `selfsignedcert` parameter or perform path traversal via the `requestId` parameter in the `checkAccessRequest` endpoint. The vulnerability is patched in version 2.28.0.
Affected products
- Signal K signalk-server <= 2.27.0
Timeline
- 2026-06-16: advisory: GitHub Advisory published
- 2026-06-18: disclosed
- 2026-06-16: patched: Version 2.28.0 released
References
- https://api.github.com/users/anushkavirgaonkar
- https://github.com/anushkavirgaonkar
- https://api.github.com/users/anushkavirgaonkar/gists%7B/gist_id%7D
- https://api.github.com/users/anushkavirgaonkar/repos
- https://avatars.githubusercontent.com/u/41755334?v=4
- https://api.github.com/users/anushkavirgaonkar/events%7B/privacy%7D