CVE-2026-118690

Summary

Signal K Server before 2.33.0 lacks authentication on the /skServer/ziplogs endpoint, allowing unauthenticated attackers to download log archives containing sensitive files like security.json, which stores the JWT secret key and enables token forgery and persistent admin account creation.

Exploitability

Trivial to exploit over the network with no privileges or user interaction required, as long as the vulnerable endpoint is reachable.

Blast radius

Full server compromise including confidentiality, integrity, and availability impacts: attackers can forge admin tokens, create persistent backdoor accounts, and fully control the server.

Detection

Look for unauthenticated HTTP GET requests to /skServer/ziplogs in web server access logs; a successful request will return a ZIP file (Content-Type: application/zip) without prior authentication headers or session cookies.

Prioritized remediation

Upgrade to Signal K Server version 2.33.0 or later, which patches the missing authentication on the /skServer/ziplogs endpoint.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.