Signal K Server EUVD-2026-112491

Exploitation requires network reachability to the Signal K server's HTTP interface and the presence of the unauthenticated /skServer/ziplogs endpoint, whose handler zips getFullLogDir(app) - normally the config directory - and therefore includes security.json containing the HS256 secretKey. The practical prerequisite is that security is enabled so that security.json with a signing key exists; the sibling /skServer/logfiles/ route is admin-protected while ziplogs was not, so no credentials, configuration change, or user interaction is needed. Limiting factors: the server must be reachable by the attacker (the GHSA notes many instances run on the default port and are internet-discoverable, but non-exposed LAN/vessel deployments are not remotely reachable), and all versions before 2.33.0 are affected (confirmed on 2.32.0).

All available signals align toward high real-world risk, with one caveat about exposure scale. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, and the vuln.today Decision label is act_now - the strongest urgency signal in the input. The source-code evidence is unusually strong: the fixing commit adds exactly one line (addAdminMiddleware on the /skServer/ziplogs route), confirming the root cause is a missing authentication check (CWE-306) rather than a theoretical weakness, and the GHSA advisory walks the full chain from unauthenticated ZIP download to secretKey (CWE-312) disclosure to forged admin JWT to persistent admin account. Impact is genuinely VC:H/VI:H/VA:H: full administrative takeover of the Signal K server. The tempering factors are exposure and exploitation status: no CISA KEV entry, no EPSS score, and no confirmed public exploit are present in the input, and the GHSA notes only around 66 internet-exposed servers found via Shodan - so this is a critical flaw in a small, niche population rather than a mass-exploitation event. No signals conflict; the only missing data is EPSS and any active-exploitation telemetry.

A remote attacker on the network issues a single unauthenticated GET request to /skServer/ziplogs and receives a ZIP archive containing security.json, which holds the HS256 JWT secretKey. Using that symmetric key the attacker forges a valid admin JWT, creates a persistent administrator account through the authenticated API, and then logs in normally - gaining lasting control over NMEA routing, plugins, and alarms. No public working exploit is identified in the input, but the GHSA advisory documents the exact steps and the trigger is a simple HTTP request against a default endpoint.