PT-2026-29797 · Unknown · Signal K Server

Vashuvats · Published 2026-04-02 · Updated 2026-04-03 · CVE-2026-33951

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Signal K Server versions prior to 2.24.0-beta.1

Description The Signal K Server has an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities. The endpoint, accessible via PUT /signalk/v1/api/sourcePriorities, does not enforce authentication or authorization checks and directly assigns user-controlled input to the server configuration. Attackers can influence which GPS, AIS, or other sensor data sources are trusted by the system. The changes are immediately applied and persisted to disk. The vulnerable code is located in src/serverroutes.ts lines 1064-1076 within the source priorities configuration handler function. The issue stems from missing authentication, direct configuration assignment, persistent storage of malicious configuration, live configuration updates, and a lack of input validation.

Recommendations Update Signal K Server to version 2.24.0-beta.1 or later.

Fix

Improper Access Control

Missing Authentication

Weakness Enumeration

CWE-284

CWE-306

Related Identifiers

CVE-2026-33951

GHSA-GFMV-VH34-H2X5

Affected Products

Signal K Server

References · 5

• https://github.com/SignalK/signalk-server/security/advisories/GHSA-gfmv-vh34-h2x5 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gfmv-vh34-h2x5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33951 · Security Note
• https://github.com/SignalK/signalk-server · Note
• https://github.com/SignalK/signalk-server/releases/tag/v2.24.0-beta.1 · Note