Signal K Server: Unauthenticated Source Priorities Manipulation

Description

The SignalK Server exposes an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities. This endpoint, accessible via PUT /signalk/v1/api/sourcePriorities, does not enforce authentication or authorization checks and directly assigns user-controlled input to the server configuration.

Recommendation

Update the signalk-server package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.24.0-beta.1
• Patched version(s): 2.24.0-beta.1

References

• GHSA-gfmv-vh34-h2x5
• CVE-2026-33951
• CWE-284
• CWE-306
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths - CVE-2026-39320
• Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force) - CVE-2026-41893
• Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity - CVE-2026-33950
• Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE) - CVE-2025-66398

You might also like:

Exploiting Server Version Disclosure

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

signalk-server