{"id":"CVE-2026-118690","published":"2026-10-28T22:17:13.070","lastModified":"2026-10-28T22:17:13.070","description":"Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/SignalK/signalk-server","tags":[]},{"url":"https://github.com/SignalK/signalk-server/blob/v2.32.0/src/interfaces/logfiles.js#L30-L91","tags":[]},{"url":"https://github.com/SignalK/signalk-server/commit/728bab82742d16c54e50525b95dc9b6e32396107","tags":[]},{"url":"https://github.com/SignalK/signalk-server/releases/tag/v2.33.0","tags":[]},{"url":"https://github.com/SignalK/signalk-server/security/advisories/GHSA-4w32-qx5g-cpwv","tags":[]},{"url":"https://www.vulncheck.com/advisories/signal-k-server-before-2.33.0-missing-authentication-via-skserver-ziplogs","tags":[]}],"exploitRefs":[{"url":"https://github.com/SignalK/signalk-server","tags":[]},{"url":"https://github.com/SignalK/signalk-server/blob/v2.32.0/src/interfaces/logfiles.js#L30-L91","tags":[]},{"url":"https://github.com/SignalK/signalk-server/commit/728bab82742d16c54e50525b95dc9b6e32396107","tags":[]},{"url":"https://github.com/SignalK/signalk-server/releases/tag/v2.33.0","tags":[]},{"url":"https://github.com/SignalK/signalk-server/security/advisories/GHSA-4w32-qx5g-cpwv","tags":[]}],"hasPoc":true,"ai":{"summary":"Signal K Server before 2.33.0 lacks authentication on the /skServer/ziplogs endpoint, allowing unauthenticated attackers to download log archives containing sensitive files like security.json, which stores the JWT secret key and enables token forgery and persistent admin account creation.","exploitability":"Trivial to exploit over the network with no privileges or user interaction required, as long as the vulnerable endpoint is reachable.","blast_radius":"Full server compromise including confidentiality, integrity, and availability impacts: attackers can forge admin tokens, create persistent backdoor accounts, and fully control the server.","remediation":"Upgrade to Signal K Server version 2.33.0 or later, which patches the missing authentication on the /skServer/ziplogs endpoint.","detection":"Look for unauthenticated HTTP GET requests to /skServer/ziplogs in web server access logs; a successful request will return a ZIP file (Content-Type: application/zip) without prior authentication headers or session cookies.","tags":["auth-bypass","jwt-exploit","web","log-exposure"],"model":"garnet-coder","analyzedAt":"2026-10-29T08:42:17.355Z"}}