External risk intelligence

Signal K Server Log Archive Download Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-118690

Signal K is a server-based platform designed for data exchange in marine environments, often exposed as a web interface or API for monitoring and management. Because these systems are frequently deployed to provide remote data access and management, the web-accessible endpoint identified in the vulnerability is commonly exposed to the network, making external reachability a likely deployment pattern.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Signal K Server that could allow unauthorized remote access to sensitive log data. This access could potentially be leveraged to gain administrative control over the server. The main concern is confirming whether your deployment is affected and what exposure might exist.

Unauthenticated attackers can download log archives.
This could lead to forged administrator tokens and server control.
Confirm relevance and potential exposure to your operations.

Attack Path

How an attacker could exploit the issue

An attacker can reach a vulnerable log download feature over the network without any authentication. By downloading log archives, they can find sensitive information that allows them to forge administrator credentials and gain complete control of the server.

Remote access to the server is required.
Accessing the log download endpoint triggers the vulnerability.
Risk of full server compromise and persistent admin access.

Live Threat

Current exploitation, exposure, and threat context

Signal K Server, when accessible remotely, could allow unauthenticated attackers to download log archives. Extracting the JWT secret key from these archives would enable attackers to forge administrator tokens and establish persistent administrative control over the server.

Server log data and configuration.
Unauthenticated download of log archives.
Full server control and persistent admin access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Signal K Server's missing authentication vulnerability necessitates immediate attention from application and platform owners. The first step is to inventory all Signal K Server instances, determine their network exposure, and confirm their criticality to business operations. Once identified, the accountable owner should be engaged to plan for mitigation, prioritizing systems that are externally reachable or handle sensitive data.

Identify Signal K Server instances and ownership.
Verify external reachability and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Signal K Server?

Signal K Server is a software platform built for the marine industry to facilitate data exchange between boat sensors, navigational instruments, and monitoring applications. It acts as a central hub, collecting and serving data over a network, which users typically access via a web interface or API to manage vessel information and hardware connectivity.

What does CWE-306 mean for CVE-2026-118690?

CWE-306 refers to a Missing Authentication for Critical Function weakness. In this specific case, it means the software's log archive download feature performs a sensitive action without verifying who is requesting the data. Because this check is absent, anyone who can reach the server endpoint can retrieve files that contain internal secrets, such as security keys used to authenticate administrators.

How is this vulnerability triggered?

An attacker triggers this by sending a direct network request to the /skServer/ziplogs endpoint on a vulnerable server. No special setup or user credentials are required to initiate the download. The vulnerability is tied specifically to this log retrieval path; it is not triggered by standard, authenticated interactions with the server's primary data streams or dashboard features.

Is my Signal K Server instance at risk?

Halo Surface Signal indicates that because Signal K is designed for remote data access, these servers are frequently reachable over the network. If your instance is configured to be internet-facing or accessible on a broad internal network, it is likely reachable by an attacker. You should evaluate your deployment's network placement to determine if the vulnerable endpoint is accessible beyond your local control.

What are the first steps to address this?

Begin by identifying all running instances of Signal K Server and determining who manages them. Once you have an inventory, confirm which instances are reachable over the network and prioritize those for review. Work with the responsible administrators to plan an update to version 2.33.0 or later, as this release addresses the authentication flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.