PT-2026-29804 · Signal · Signal K Server

Published 2026-04-02 · Updated 2026-04-02 · CVE-2026-35038

Mitre

CVSS v4.0

5.3

Medium

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, there is an arbitrary prototype read vulnerability via from field bypass. This vulnerability allows a low-privileged authenticated user to bypass prototype boundary filtering to extract internal functions and properties from the global prototype object this violates data isolation and lets a user read more than they should. This issue has been patched in version 2.24.0.

Fix

Information Disclosure

Out of bounds Read

RCE

Weakness Enumeration

CWE-200

CWE-125

CWE-20

Related Identifiers

CVE-2026-35038

Affected Products

Signal K Server

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-35038 · Security Note
• https://github.com/SignalK/signalk-server/releases/tag/v2.24.0 · Note
• https://github.com/SignalK/signalk-server/security/advisories/GHSA-qh3j-mrg8-f234 · Note