CVE-2026-33951

The record

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.1, the SignalK Server exposes an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities. This endpoint, accessible via PUT /signalk/v1/api/sourcePriorities, does not enforce authentication or authorization checks and directly assigns user-controlled input to the server configuration. As a result, attackers can influence which GPS, AIS, or other sensor data sources are trusted by the system. The changes are immediately applied and persisted to disk, allowing the manipulation to survive server restarts. This issue has been patched in version 2.24.0-beta.1.

Affected packages

Related vulnerabilities

• GHSA-gfmv-vh34-h2x5 Signal K Server: Unauthenticated Source Priorities Manipulation Same vulnerability
• GHSA-q59x-jc9f-gfqf Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints Also affects signalk-server
• CVE-2026-41893 Signal K Server is a server application that runs on a central hub in a boat. Also affects signalk-server
• GHSA-vmfm-ch9h-5c7g Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force) Also affects signalk-server
• GHSA-7gcj-phff-2884 Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via… Also affects signalk-server
• CVE-2026-39320 Signal K Server is a server application that runs on a central hub in a boat. Also affects signalk-server
• GHSA-cxj8-ggf2-p57c Signal K Server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow Also affects signalk-server
• GHSA-x8hc-fqv3-7gwf Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity Also affects signalk-server