Signal K Server <= 2.18.0 - Information Disclosure

Signal K Server versions up to and including 2.18.0 expose the /skServer/serialports, /skServer/availablePaths, and /skServer/hasAnalyzer endpoints without authentication. These routes were missing from the authentication middleware configuration, letting any unauthenticated user retrieve the ful...

cve-2025-66398

CVE-2025-66398 — Signal K Server RCE PoC 📜 Description CVE-2025-66398 is a Signal K Server issue where an unauthenticated attacker can poison the server’s restore state via /skServer/validateBackup, then hijack config via /skServer/restore to inject a backdoor admin account and optionally achieve...

cve-2025-66398

⚠️ cve-2025-66398 - Simple RCE Proof of Concept Tool ⚙️ About This Tool This project demonstrates a remote code execution RCE vulnerability in Signal K Server versions 2.18.0 and earlier. The proof of concept PoC shows how an attacker could run commands on a vulnerable device. This tool is designed...

CVE-2026-55591

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints...

CVE-2026-55591 Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints...

EUVD-2026-78677

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints...

CVE-2026-55591 Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints...

CVE-2026-55591 Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints...

CVE-2026-55591

Signal K Server (signalk-server, a boat central-hub server application) versions up to 2.27.0 contain a Server-Side Request Forgery (SSRF) in makeRemoteRequest() within src/serverroutes.ts. The function accepts attacker-controlled host, port, useTLS, and selfsignedcert parameters via the testSign...

CVE-2026-55591: Server-Side Request Forgery (SSRF)

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints...

Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

Summary signalk-server versions up to and including 2.27.0 contain a Server-Side Request Forgery SSRF vulnerability in three administrative endpoints used for remote Signal K server connection management. The makeRemoteRequest function accepts attacker-controlled host, port, useTLS, and...

GHSA-Q59X-JC9F-GFQF Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

Summary signalk-server versions up to and including 2.27.0 contain a Server-Side Request Forgery SSRF vulnerability in three administrative endpoints used for remote Signal K server connection management. The makeRemoteRequest function accepts attacker-controlled host, port, useTLS, and...

NPM: Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

NPM: Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints vulnerability discovered by ? in WordPress Npm signalk-server versions = 2.27.0...

CVE-2026-41893

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints POST /login and POST /signalk/v1/auth/login are protected by express-rate-limit default: 100 attempts per 10-minute window, configurable via HTTPRATELIMITS. The WebSocke...

CVE-2026-41893

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints POST /login and POST /signalk/v1/auth/login are protected by express-rate-limit default: 100 attempts per 10-minute window, configurable via HTTPRATELIMITS. The WebSocke...

CVE-2026-41893 Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints POST /login and POST /signalk/v1/auth/login are protected by express-rate-limit default: 100 attempts per 10-minute window, configurable via HTTPRATELIMITS. The WebSocke...

CVE-2026-41893

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints POST /login and POST /signalk/v1/auth/login are protected by express-rate-limit default: 100 attempts per 10-minute window, configurable via HTTPRATELIMITS. The WebSocke...

CVE-2026-41893 Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints POST /login and POST /signalk/v1/auth/login are protected by express-rate-limit default: 100 attempts per 10-minute window, configurable via HTTPRATELIMITS. The WebSocke...

CVE-2026-41893 Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints POST /login and POST /signalk/v1/auth/login are protected by express-rate-limit default: 100 attempts per 10-minute window, configurable via HTTPRATELIMITS. The WebSocke...

CVE-2026-41893: Improper Restriction of Excessive Authentication Attempts

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints POST /login and POST /signalk/v1/auth/login are protected by express-rate-limit default: 100 attempts per 10-minute window, configurable via HTTPRATELIMITS. The WebSocke...