CVE-2025-68273
Medium · 5.3Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints
CVSS
5.3
EPSS
0.8%
Published
Jan 2, 2026
CISA due date
—
The record
An unauthenticated information disclosure vulnerability allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | signalk-server | 0 | 2.19.0 |
Related vulnerabilities
- GHSA-fpf5-w967-rr2m Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints Same vulnerability
- GHSA-q59x-jc9f-gfqf Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints Also affects signalk-server
- CVE-2026-41893 Signal K Server is a server application that runs on a central hub in a boat. Also affects signalk-server
- GHSA-vmfm-ch9h-5c7g Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force) Also affects signalk-server
- GHSA-7gcj-phff-2884 Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via… Also affects signalk-server
- CVE-2026-39320 Signal K Server is a server application that runs on a central hub in a boat. Also affects signalk-server
- GHSA-cxj8-ggf2-p57c Signal K Server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow Also affects signalk-server
- GHSA-gfmv-vh34-h2x5 Signal K Server: Unauthenticated Source Priorities Manipulation Also affects signalk-server