CVE-2026-118690

CRITICAL

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.

CVSS v3.1 Score

9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 10/28/2026Modified: 10/29/2026

Related Intelligence (1)

CRITICALVulnerability

NVD CRITICAL: CVE-2026-118690 — Signal K Server before 2.33.0 contains a missing authentication vulnerability th...

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.

CVE-2026-118690
NIST NVD

References (6)

https://github.com/SignalK/signalk-serverhttps://github.com/SignalK/signalk-server/blob/v2.32.0/src/interfaces/logfiles.js#L30-L91https://github.com/SignalK/signalk-server/commit/728bab82742d16c54e50525b95dc9b6e32396107https://github.com/SignalK/signalk-server/releases/tag/v2.33.0https://github.com/SignalK/signalk-server/security/advisories/GHSA-4w32-qx5g-cpwvhttps://www.vulncheck.com/advisories/signal-k-server-before-2.33.0-missing-authentication-via-skserver-ziplogs