CVE-2026-33950: Signal K Server Privilege Escalation via Admin Role Injection
Summary
CVE-2026-33950: Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity. Affects signalk-server versions < 2.24.0-beta.4. Fixed in 2.24.0-beta.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Signal K Server is an open-source server designed for marine data management, enabling users to connect and manage various data sources related to vessel operations. It provides functionalities for real-time data access, configuration, and security management. However, it has a critical vulnerability that allows unauthorized users to gain admin privileges, compromising the integrity of the server.
Vulnerability Detail
The vulnerability arises from the /skServer/enableSecurity endpoint, which is intended for initial admin account setup. This endpoint remains open even after security is enabled, allowing any unauthenticated user to inject new admin accounts. The server fails to validate the 'type' field in the request body, leading to potential privilege escalation. An attacker can exploit this vulnerability to create unauthorized admin accounts, gaining full control over the server and sensitive data.
How To Fix
Latest published version: 2.34.0 as of 23 Oct 2026
npm install signalk-server@2.34.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.24.0-beta.4
This is the first release that contains the fix.
npm install signalk-server@2.24.0-beta.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the /skServer/enableSecurity endpoint by implementing IP whitelisting or using a firewall to block unauthorized requests until the package is updated.
Conclusion
The CVE-2026-33950 vulnerability in Signal K Server poses a significant risk, allowing unauthorized users to gain admin access. It is crucial to update the package to the latest version to mitigate this risk and ensure the security of your server.
See every vulnerability recorded for signalk-server →
FAQ
CVE-2026-33950 is a critical vulnerability in the Signal K Server that allows unauthorized users to create admin accounts through an insecure endpoint.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
An attacker can gain full administrative access to the Signal K server, allowing them to modify sensitive data, alter configurations, and access restricted endpoints.
The CVSS score of this vulnerability is 9.4, indicating a critical level of severity.
You can implement IP whitelisting or use a firewall to restrict access to the /skServer/enableSecurity endpoint as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for signalk-server.
