Signalk Server CVE-2026-35038

The CVSS 4.0 vector reveals a moderate but real risk profile: network-accessible (AV:N), low attack complexity (AC:L), authenticated access required (PR:L), and low confidentiality impact (VC:L). The EPSS indicator (E:P) suggests proof-of-concept code is anticipated or available. While CVSS scoring caps this at 5.3 due to the confidentiality-only impact and authenticated requirement, the real-world risk depends on two factors: (1) deployment context-if the Signal K Server is internet-exposed or on a shared boat network with multiple crew members, lateral movement and privilege escalation chains become plausible; (2) sensitivity of exposed data-maritime systems can include navigation, fuel, electrical, and safety subsystem metadata. The authentication requirement significantly reduces opportunistic attack surface, but it does not eliminate insider risk or risk from compromised low-privilege accounts. This is not a critical emergency, but it merits prompt patching in any Signal K deployment handling sensitive operational data.

An authenticated crew member or technician with low-privilege access to a Signal K Server instance on a boat's network crafts a malicious query with a specially formatted from field value designed to bypass prototype boundary filtering. The server processes this request and inadvertently exposes internal functions and properties from the global JavaScript prototype object-potentially revealing sensitive configuration, internal state, or debug information. The attacker extracts this metadata without modification, violating data isolation expectations, and uses the intelligence for reconnaissance toward a subsequent lateral movement or privilege escalation attack. Proof-of-concept code may be publicly available, lowering the barrier to exploitation.