CVE-2026-118690: Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Any Signal K Server deployment running a version before 2.33.0 is exposed if an unauthenticated remote attacker can reach the /skServer/ziplogs endpoint.
What can an attacker do after accessing the log archive?
The archive can contain security.json, from which the attacker can extract the JWT secretKey. They can then forge administrator tokens, create persistent administrator accounts, and gain full control of the server.
How can I determine whether a server is affected?
Check whether the Signal K Server version is earlier than 2.33.0. Also assess whether /skServer/ziplogs is reachable without authentication and whether it returns a log archive containing security.json.
What should be done if exposure may have occurred?
Update to 2.33.0 or later. Because the JWT secretKey may have been exposed, investigate for unauthorized administrator accounts and treat the secret as compromised if the endpoint was accessible.