Read the docs
TI-2026-26301 Aliases CVE-2026-33951GHSA-gfmv-vh34-h2x5

signalk-server: Unauthenticated Source Priorities Manipulation

Priority LOW 36CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.1, the SignalK Server exposes an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities. This endpoint, accessible via PUT /signalk/v1/api/sourcePriorities, does not enforce authentication or authorization checks and directly assigns user-controlled input to the server configuration. As a result, attackers can influence which GPS, AIS, or other sensor data sources are trusted by the system. The changes are immediately applied and persisted to disk, allowing the manipulation to survive server restarts. This issue has been patched in version 2.24.0-beta.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00322 25th percentileScored 2026-11-07
Fix Fixed signalk-server (SignalK): 2.24.0-beta.1signalk-server (npm): 2.24.0-beta.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SignalKsignalk-serverbefore 2.24.0-beta.12.24.0-beta.1Patch availableCNA
—signalk-server (npm)before 2.24.0-beta.12.24.0-beta.1Patch availableGHSA-gfmv-vh34-h2x5
  • signalk-server VendorSignalK Affected before 2.24.0-beta.1 Fixed in 2.24.0-beta.1 Patch available CNA
  • signalk-server (npm) Vendor— Affected before 2.24.0-beta.1 Fixed in 2.24.0-beta.1 Patch available GHSA-gfmv-vh34-h2x5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:signalk:signal_k_server:*:*:*:*:*:*:*:*before 2.24.0VulnerableSignalK
  • cpe:2.3:a:signalk:signal_k_server:*:*:*:*:*:*:*:* Versions before 2.24.0 Vulnerable ·SignalK

Remediation

  • Fix · CNA signalk-server (SignalK) Fixed in 2.24.0-beta.1
  • Fix · GHSA-gfmv-vh34-h2x5 signalk-server (npm) Fixed in 2.24.0-beta.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33951
  2. 2026-10-03 Alias added: GHSA-gfmv-vh34-h2x5

References

Advisory 2

Other 2

  • TI-2026-26300 signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity CVSS 3.1CRITICAL 9.4
  • TI-2025-40835 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.7
  • TI-2025-42138 Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling CVSS 3.1CRITICAL 9.1
  • TI-2026-30295 Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force) CVSS 4.0HIGH 8.7
  • TI-2025-42657 Signal K Server Vulnerable to Access Request Spoofing CVSS 3.1HIGH 8.8
  • TI-2026-18939 RCE - Command Injection in Signal K set-system-time plugin CVSS 3.1CRITICAL 10.0
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences