SECURITYCRITICALCVE-2026-118690

CVE-2026-118690: Signal K Server Unauthenticated Log Download Leads to Admin Takeover

Signal K Server before 2.33.0 exposes /skServer/ziplogs without authentication, letting attackers steal the JWT secret and forge admin tokens (CVSS 9.8).

Dylan H.

Security Team

October 29, 2026
2 min read
CVE-2026-118690: Signal K Server Unauthenticated Log Download Leads to Admin Takeover

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Signal K Server — all versions before 2.33.0

Executive Summary

CVE-2026-118690 is a critical missing-authentication vulnerability (CVSS 9.8) in Signal K Server, the open-source data hub commonly used on boats and marine IoT gateways. Versions before 2.33.0 allow an unauthenticated remote attacker to download server log archives through the /skServer/ziplogs endpoint. Because the archive contains security.json, the attacker can extract the JWT secretKey, forge administrator tokens, and create persistent access.

NVD published the entry on 2026-10-28.

Vulnerability Details

FieldDetails
CVECVE-2026-118690
CVSS Score9.8 (Critical)
TypeMissing Authentication for a Critical Function
ProductSignal K Server
Affected VersionsBefore 2.33.0
Endpoint/skServer/ziplogs
Authentication RequiredNone
Published2026-10-28

Attack Chain

  1. The attacker sends an unauthenticated request to /skServer/ziplogs on a reachable Signal K Server.
  2. The server returns a ZIP archive of its logs.
  3. The archive includes security.json, which holds the JWT secretKey used to sign authentication tokens.
  4. With the secret, the attacker signs their own administrator JWTs.
  5. The forged tokens are used to create persistent access, such as additional accounts or credentials.

Because the signing key is the root of trust for the server, a leaked key stays dangerous after the initial download until it is rotated.

Impact

  • Full administrative control of the Signal K Server instance
  • Exposure of configuration and log data held in the archive
  • Persistent access that survives a simple restart
  • Potential visibility into, or influence over, connected vessel data feeds

Signal K deployments are often reachable from shore networks or the internet for remote monitoring, which raises the exposure of this flaw.

Remediation

  1. Upgrade to Signal K Server 2.33.0 or later.
  2. Rotate the JWT secretKey in security.json after upgrading, since any previously downloaded archive exposes the old key. Invalidate existing tokens.
  3. Review users and access tokens for accounts or devices you did not create.
  4. Remove direct internet exposure. Put the server behind a VPN or an authenticating reverse proxy.
  5. Check web logs for unauthenticated requests to /skServer/ziplogs.

References