CVE-2026-123807

Summary

Signal K Server and @signalk/resources-provider contain a path traversal vulnerability (CWE-22) in the v2 REST API's /resources endpoint, allowing unauthenticated or authenticated attackers with read access to read arbitrary files on the server, including sensitive security.json which contains JWT secrets and password hashes. This enables token forgery and full administrative compromise via provider configuration manipulation.

Exploitability

Exploitation is straightforward for remote attackers: anonymous reads are possible if allow_readonly is enabled; otherwise a readonly user token suffices, and no user interaction or complex conditions are required.

Blast radius

Successful exploitation leads to complete system compromise: attackers can forge admin tokens, deploy malicious Execute providers to run arbitrary commands as the server process, and persist access across restarts—posing severe risk to marine vessel control systems.

Detection

Defenders should monitor for anomalous file access patterns in server logs, specifically requests to /signalk/v2/api/resources/ with resourceId values containing path traversal sequences (e.g., ../) or attempts to access files outside the expected resources directory such as security.json; also watch for unexpected provider creation events via POST /skServer/providers.

Prioritized remediation

Upgrade Signal K Server to version 2.34.0 or later and @signalk/resources-provider to version 1.5.3 or later immediately.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.