CVE-2026-33951 Details
Description
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.1, the SignalK Server exposes an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities. This endpoint, accessible via PUT /signalk/v1/api/sourcePriorities, does not enforce authentication or authorization checks and directly assigns user-controlled input to the server configuration. As a result, attackers can influence which GPS, AIS, or other sensor data sources are trusted by the system. The changes are immediately applied and persisted to disk, allowing the manipulation to survive server restarts. This issue has been patched in version 2.24.0-beta.1.
A vulnerability exists in Signal K Server versions prior to 2.24.0-beta.1, where an unauthenticated HTTP endpoint allows remote attackers to alter navigation data source priorities. The vulnerability is present in the source priorities configuration handler, accessible via PUT /signalk/v1/api/sourcePriorities. This endpoint lacks authentication and authorization checks, enabling attackers to directly manipulate user-controlled input in the server configuration. The changes are immediately applied and saved to disk, persisting through server restarts. This vulnerability could disrupt navigation data processing by altering which GPS, AIS, or other sensor data sources are considered reliable by the system.
Users can upgrade to Signal K Server version 2.24.0-beta.1 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/SignalK/signalk-server/releases/tag/v2.24.0-beta.1 | [email protected] | ProductRelease Notes |
| https://github.com/SignalK/signalk-server/security/advisories/GHSA-gfmv-vh34-h2x5 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| signalk signal k server | < 2.24.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | Initial Analysis | [email protected] |
| Apr 2, 2026 | New CVE Received | [email protected] |