CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-118690 — Signal K Server before 2.33.0 contains a missing authentication vulnerability th...

·Source: NIST NVD

Updated:

Executive Summary

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.

Analysis

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control. CVSS Score: 9.8. Published: 2026-10-28T22:17:13.070.

Indicators of Compromise (1)

CVE (1)
CVE-2026-118690
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 28, 2026. Verified by: NIST.

Related Threats

HIGHRansomware

Hospital Ransomware Attacker Receives 70 Month Jail Term

A Ukrainian affiliate of the Nefilim & Hive ransomware operations who attacked hospitals, government entities, and businesses over a three-year […] The post Hospital Ransomware Attacker Receives 70 Month Jail Term appeared first on The HIPAA Journal .

HIPAA Journal
HIGHRansomware

Hive ransomware affiliate jailed, years after FBI infiltrated the gang’s systems

A Ukrainian man who carried out ransomware attacks for both the Nefilim and Hive gangs, including attacks on law firms and a healthcare provider during the COVID-19 pandemic, has been sentenced to 70 months in a US prison. Read more in my article on the Hot for Security blog.

Graham Cluley
HIGHRansomware

Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison

Artem Stryzhak was sentenced to 70 months in prison after pleading guilty to using Nefilim ransomware in attacks. The post Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison appeared first on SecurityWeek .

SecurityWeek