CVE-2026-118690
criticalSignal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /sk…
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)
Timeline (UTC)
Published: 2026-10-28 22:17
Modified: 2026-10-28 22:17
NVD status: Received
Last synced 7 hours ago
Verified against the source API 2026-10-28 22:34 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/SignalK/signalk-server disclosure@vulncheck.com
- https://github.com/SignalK/signalk-server/blob/v2.32.0/src/interfaces/logfiles.js#L30-L91 disclosure@vulncheck.com
- https://github.com/SignalK/signalk-server/commit/728bab82742d16c54e50525b95dc9b6e32396107 disclosure@vulncheck.com
- https://github.com/SignalK/signalk-server/releases/tag/v2.33.0 disclosure@vulncheck.com
- https://github.com/SignalK/signalk-server/security/advisories/GHSA-4w32-qx5g-cpwv disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/signal-k-server-before-2.33.0-missing-authentication-... disclosure@vulncheck.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-28 22:34 UTC · record ↗