SignalK vulnerabilities
We track 12 vulnerabilities in SignalK products across 3 products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on November 9, 2026.
Latest SignalK vulnerabilities
- 9.8 Critical severity
signalk-server: Improper Limitation of a Pathname to a Restricted Directory
Signal K Server is a server application that runs on a central hub in a boat. From 2.0.0 until 2.34.0 for Signal K Server and from 1.0.0 until 1.5.3 for @signalk/resources-provider, the v2 REST route GET /signalk/v2/api/resources/:resourceType/:resourceId acce
- 9.8 Critical severity
signalk-server: Missing Authentication for Critical Functionality
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge
- 7.5 High severity
signalk-server: Improper Restriction of Excessive Authentication Attempts
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) are protected by express-rate-limit (default: 100 attempts per 10-minute window, confi
- 7.5 High severity
signalk-server: Uncontrolled Resource Consumption
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unesc
- 7.5 High severity
signalk-server: Improper Access Control
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.1, the SignalK Server exposes an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities. This endpoint, a
- 9.4 Critical severity
signalk-server: Improper Authorization
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a privilege escalation vulnerability by Admin Role Injection via /enableSecurity. An unauthenticated attacker can gain full Administrator acc
- 8.8 High severity
signalk-server: Improper Neutralization of Special Elements used in an OS Command
Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-tim
- 8.8 High severity
signalk-server: Authentication Bypass by Spoofing
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access request system have two related features that when combined by themselves and with an information disclosure vulnerability enable convincing so
- 9.1 Critical severity
signalk-server: Authentication Bypass Using an Alternate Path or Channel
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 expose two features that can be chained together to steal JWT authentication tokens without any prior authentication. The attack combines WebSocket-based req
- 7.2 High severity
signalk-server: Improper Control of Generation of Code
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. While the endpoint validates that the package name exists
- 7.5 High severity
signalk-server: Uncontrolled Resource Consumption
Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint (`/signalk/
- 8.8 High severity
signalk-server: Improper Neutralization of Special Elements used in an OS Command
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the att