PT-2026-29796 · Unknown · Signal K Server

Vashuvats · Published 2026-04-02 · Updated 2026-04-04 · CVE-2026-33950

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Signal K Server versions prior to 2.24.0-beta.4

Description Signal K Server, a server application used in marine navigation systems, contains a privilege escalation issue. An unauthenticated attacker can exploit this to gain full Administrator access to the server. This is achieved through Admin Role Injection via the '/enableSecurity' API endpoint. Successful exploitation allows modification of sensitive vessel routing data, alteration of server configurations, and access to restricted endpoints.

Recommendations Update Signal K Server to version 2.24.0-beta.4 or later.

Fix

LPE

Missing Authorization

Authentication Bypass Using an Alternate Path or Channel

Improper Authorization

Weakness Enumeration

CWE-862

CWE-288

CWE-285

Related Identifiers

CVE-2026-33950

GHSA-X8HC-FQV3-7GWF

Affected Products

Signal K Server

References · 9

• https://github.com/SignalK/signalk-server/security/advisories/GHSA-x8hc-fqv3-7gwf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33950 · Security Note
• https://osv.dev/vulnerability/GHSA-x8hc-fqv3-7gwf · Vendor Advisory
• https://github.com/SignalK/signalk-server · Note
• https://github.com/SignalK/signalk-server/releases/tag/v2.24.0-beta.4 · Note
• https://twitter.com/0dayPublishing/status/2039740748292051204 · Twitter Post
• https://twitter.com/CveFindCom/status/2039760508153221216 · Twitter Post
• https://twitter.com/pulsepatchio/status/2040440777189245020 · Twitter Post
• https://twitter.com/TheHackerWire/status/2039976200542781456 · Twitter Post