CVE-2026-33950

The record

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a privilege escalation vulnerability by Admin Role Injection via /enableSecurity. An unauthenticated attacker can gain full Administrator access to the SignalK server at any time, allowing them to modify sensitive vessel routing data, alter server configurations, and access restricted endpoints. This issue has been patched in version 2.24.0-beta.4.

Affected packages

Related vulnerabilities

• GHSA-x8hc-fqv3-7gwf Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity Same vulnerability
• GHSA-q59x-jc9f-gfqf Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints Also affects signalk-server
• CVE-2026-41893 Signal K Server is a server application that runs on a central hub in a boat. Also affects signalk-server
• GHSA-vmfm-ch9h-5c7g Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force) Also affects signalk-server
• GHSA-7gcj-phff-2884 Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via… Also affects signalk-server
• CVE-2026-39320 Signal K Server is a server application that runs on a central hub in a boat. Also affects signalk-server
• GHSA-cxj8-ggf2-p57c Signal K Server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow Also affects signalk-server
• GHSA-gfmv-vh34-h2x5 Signal K Server: Unauthenticated Source Priorities Manipulation Also affects signalk-server