CVE-2026-118690— Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs

Quick assessment

Affected

SignalK signalk-server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Signal K Server 2.33.0 之前的版本存在一个缺失身份验证的漏洞，允许未经身份验证的远程攻击者通过端点下载日志归档文件。攻击者可以从 ZIP 压缩包中的文件提取 JWT 密钥（secretKey），伪造管理员令牌，并创建持久性的管理员账户，从而获得对服务器的完全控制权。

CVSS 9.8 · Critical Updated Oct 29, 2026

Possible ATT&CK Techniques 3 AI

T1547 · Boot or Logon Autostart Execution T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs

Source: CVE Program / CVE List V5

Vulnerability Description

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

关键功能的认证机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
SignalK	signalk-server	0 ~ 2.33.0	-

II. Public POCs for CVE-2026-118690

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118690

请登录查看更多情报信息。

Other References for CVE-2026-118690 (6)

https://github.com/SignalK/signalk-server product
https://github.com/SignalK/signalk-server/blob/v2.32.0/src/interfaces/logfiles.js#L30-L91 technical-description
https://github.com/SignalK/signalk-server/commit/728bab82742d16c54e50525b95dc9b6e32396107 patch
https://github.com/SignalK/signalk-server/releases/tag/v2.33.0 release-notes
https://github.com/SignalK/signalk-server/security/advisories/GHSA-4w32-qx5g-cpwv vendor-advisory
https://www.vulncheck.com/advisories/signal-k-server-before-2.33.0-missing-authentication-via-skserver-ziplogs third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-118690

IV. Related Vulnerabilities

Same product: signalk-server

Same vendor: SignalK

Same weakness: CWE-306