Executive Summary
CVE-2026-123807 is a critical path traversal vulnerability (CVSS 9.8) in Signal K Server, the open-source server application that runs on a central hub aboard a boat and aggregates marine instrument data. It was published to the NVD on 2026-11-09.
The v2 REST route GET /signalk/v2/api/resources/:resourceType/:resourceId accepts a resourceId value that is not safely validated, allowing a crafted identifier to escape the intended resource directory.
Affected Versions
| Component | Affected range |
|---|---|
| Signal K Server | 2.0.0 until 2.34.0 |
| @signalk/resources-provider | 1.0.0 until 1.5.3 |
Per the NVD wording ("until"), the fixed releases are Signal K Server 2.34.0 and @signalk/resources-provider 1.5.3.
Technical Details
- Vector: HTTP GET to the v2 resources API with a malicious
resourceId - Weakness class: path traversal (unsafe path construction from user input)
- Impact: reading, or otherwise reaching, files outside the intended resources directory. The NVD excerpt available to us is truncated, so the exact post-escape impact should be confirmed against the full advisory.
- CVSS 9.8 suggests network-reachable exploitation without authentication or user interaction.
Signal K hubs are often exposed on boat Wi-Fi, marina networks, or forwarded to the internet for remote monitoring, which raises the practical risk.
Recommended Actions
- Upgrade Signal K Server to 2.34.0 or later, and
@signalk/resources-providerto 1.5.3 or later. - Do not expose the Signal K HTTP interface directly to the internet. Use a VPN or authenticated reverse proxy.
- Review web server and application logs for requests to
/signalk/v2/api/resources/containing.., encoded slashes, or other traversal patterns. - Rotate any credentials or tokens stored on the hub if suspicious access is found.