Signalk Server CVE-2026-33951

While a CVSS vector is not provided, the vulnerability exhibits critical characteristics: it requires only network access (attack vector presumed CVSS AV:N), likely no special complexity (ACV:L), zero authentication (PR:N per description), and results in integrity compromise of safety-critical navigation data (CCS:H). The absence of a CVSS score prevents formal EPSS calculation, but the attack surface (unauthenticated HTTP endpoint on a networked marine hub), persistence mechanism (disk-written configuration), and maritime safety implications (navigation data integrity) indicate high real-world risk. Unlike many authentication bypass issues that expose non-critical functions, this directly enables physical-world harm by poisoning the data sources that a vessel relies upon for course-keeping, collision avoidance, and autonomous navigation. The immediate applicability and persistence (no requiring repeated attacks) elevate practical risk above the baseline authentication bypass pattern. CISA KEV status and public exploit code status are not confirmed; however, the technical simplicity (HTTP PUT with no auth check) and clear maritime security implications make this a likely target for both sophisticated adversaries and opportunistic scanning.

An attacker conducting reconnaissance on a networked marine vessel discovers the SignalK Server's HTTP API endpoint exposed on the local network or internet. The attacker sends an unauthenticated HTTP PUT request to /signalk/v1/api/sourcePriorities with a modified JSON payload that ranks a spoofed or attacker-controlled AIS source (simulated via software or network replay) as the highest-priority navigation data feed. The server immediately applies this change without validating the requester's credentials, and persists it to disk. Subsequently, when the vessel's navigation display or autopilot queries the SignalK Server for current vessel position and course, it receives data from the attacker-controlled source, potentially causing the ship to navigate toward dangerous coordinates or collide with other vessels.