CVE-2026-115752: Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon
Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud metadata endpoints, storing image-typed responses served back via the admin UI.
Affected Software
Event History
Frequently Asked Questions
Which servers are exposed?
Signal K Server installations from 2.28.0-beta.2 through versions before 2.34.0 are affected. Exposure depends on the server fetching an App Store package icon whose signalk.appIcon value is an attacker-controlled absolute URL.
What does an attacker need to do to exploit this?
The attacker needs to publish an npm package with Signal K keywords and set its signalk.appIcon field to an absolute URL. When a vulnerable server fetches that icon, it can be induced to request loopback services, vessel-network endpoints, or cloud metadata endpoints.
What can the attacker obtain through the vulnerable fetcher?
Responses that are accepted as images can be stored by the server and served through the admin UI. This can expose information returned by internal or cloud metadata endpoints when the response is image-typed.
How can I remediate the issue?
Upgrade Signal K Server to version 2.34.0 or later. The provided data does not identify an alternative mitigation for installations that cannot yet be upgraded.