CVE-2025-66398 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restor...

CVE-2025-66398 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restor...

CVE-2025-66398

Summary (CVE-2025-66398) : Signal K Server (signalk-server) before version 2.19.0 is vulnerable to unauthenticated state pollution via the /skServer/validateBackup endpoint. An attacker can pollute the global restoreFilePath, hijack the administrator’s Restore workflow, and overwrite critical con...

PT-2026-1024

Name of the Vulnerable Software and Affected Versions Signal K Server versions prior to 2.19.0 Description Signal K Server is a server application used on boats. Versions prior to 2.19.0 contain issues that allow attackers to steal JWT authentication tokens without prior authentication. This is...

PT-2026-1025

Name of the Vulnerable Software and Affected Versions Signal K Server versions prior to 2.19.0 Description Signal K Server is a server application used on boats. Versions prior to 2.19.0 contain issues in the access request system that, when combined, can be used in social engineering attacks...

PT-2026-27686

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.19.0-08368-gfafda3b4b06b 22 Description The Linux kernel contains a flaw related to MPTCP Multipath TCP path management. A specific sequence of actions, involving setting the MPTCP subflows limit to zero,...

PT-2026-6172

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the arm64/fpsimd component related to the restoration of SVE context when SME is supported. Restoring SVE signal context can lead to an invalid state,...

Signal K Server security vulnerability

Signal K Server is a ship centralized server from Signal K open source. A security vulnerability exists in Signal K Server versions prior to 2.19.0 that originates from an unauthenticated attacker who can cause the server to crash by accessing a request endpoint flooding attack, potentially...

CVE-2025-69203: Authentication Bypass by Spoofing

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access request system have two related features that when combined by themselves and with an information disclosure vulnerability enable convincing social engineering attacks against...

Signal K Server security vulnerability

Signal K Server is a ship centralized server from Signal K open source. A security vulnerability exists in Signal K Server versions prior to 2.19.0 that stems from unauthenticated WebSocket request enumeration and token polling functionality that can be exploited by links, potentially leading to ...

PT-2026-1015

Name of the Vulnerable Software and Affected Versions Signal K Server versions prior to 2.19.0 Description Signal K Server, a server application used on boats, is susceptible to an issue where an unauthenticated attacker can manipulate the server's internal state. This manipulation occurs through...

CVE-2025-66398: Improper Neutralization of Special Elements used in an OS Command

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restor...

CVE-2025-68273: Exposure of Sensitive Information to an Unauthorized Actor

Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19.0 allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and install...

PT-2026-1022

Name of the Vulnerable Software and Affected Versions Signal K Server versions prior to 2.19.0 Description Signal K Server, a server application used on boats, has an information disclosure issue. An unauthenticated user can access sensitive system information. This includes the complete SignalK...

CVE-2025-68619: Improper Control of Generation of Code

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. While the endpoint validates that the package name exists in the npm registry as a known plugi...

CVE-2025-68272: Uncontrolled Resource Consumption

Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service DoS vulnerability in versions prior to 2.19.0 allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint /signalk/v1/access/requests. This causes a...

Signal K Server security vulnerability

Signal K Server is a ship centralized server from Signal K open source. A security vulnerability exists in Signal K Server versions prior to 2.19.0 that stems from the access request system trusting the X-Forwarded-For header and inconsistently displaying the description field with the permission...

PT-2026-1016

Name of the Vulnerable Software and Affected Versions Signal K Server versions prior to 2.19.0 Description Signal K Server is a server application used on boats. A Denial of Service DoS condition can occur in versions prior to 2.19.0. An unauthenticated attacker can crash the server by sending a...

Signal K Server Code Injection Vulnerability

Signal K Server is a ship centralized server for Signal K open source. A code injection vulnerability exists in Signal K Server versions prior to 2.19.0, which stems from the appstore interface passing version parameters directly to npm without cleaning them up, which could lead to arbitrary code...

Signal K Server security vulnerability

Signal K Server is a ship centralized server from Signal K open source. A security vulnerability exists in Signal K Server versions prior to 2.19.0 that originates from an unauthenticated attacker who can contaminate the internal state of the server, potentially leading to account takeover and...