CVE-2026-55591: signalk-server SSRF Vulnerability in Remote Connection Management
Summary
CVE-2026-55591: Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints. Affects signalk-server versions < 2.28.0. Fixed in 2.28.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
signalk-server is an open-source server that facilitates the management and communication of maritime data using the Signal K protocol. It allows users to connect various devices and services to share and visualize data in real-time. The server is designed to be extensible and supports various plugins for added functionality. However, versions up to and including 2.27.0 are vulnerable to a Server-Side Request Forgery (SSRF) attack, which can lead to unauthorized access to internal network resources.
Vulnerability Detail
The vulnerability arises from the makeRemoteRequest() function, which accepts user-controlled parameters such as host, port, useTLS, and selfsignedcert without proper validation. This oversight allows attackers to make arbitrary HTTP/HTTPS requests to internal resources, cloud metadata services, and other unintended destinations. The endpoints are accessible without authentication in default configurations, making them particularly susceptible to exploitation. Attackers can probe internal networks, exfiltrate sensitive data from cloud metadata services, and potentially access internal APIs, leading to significant security risks.
How To Fix
Minimum fixed version
2.28.0
This is the first release that contains the fix.
npm install signalk-server@2.28.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the vulnerable endpoints by configuring security settings in your signalk-server installation. Ensure that the server is not running in a default state without authentication. Additionally, consider using a firewall to block access to these endpoints from untrusted networks.
Conclusion
The SSRF vulnerability in signalk-server versions up to 2.27.0 poses significant security risks, allowing attackers to exploit the server for unauthorized access to internal resources. It is crucial to update to version 2.28.0 or later to mitigate these risks and ensure the security of your application.
See every vulnerability recorded for signalk-server →
FAQ
SSRF is a type of security vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially leading to unauthorized access or data leakage.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can identify if your application is affected by this vulnerability.
The impacts include internal network scanning, cloud metadata exfiltration, unauthorized access to internal services, and potential lateral movement within containerized environments.
Yes, you can implement security measures such as restricting access to the vulnerable endpoints and using a firewall to block untrusted access until you can apply the patch.
The CVSS score of this vulnerability is 5.8, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for signalk-server.
