CVE-2026-118690 is a critical missing authentication flaw in Signal K Server before 2.33.0. It lets unauthenticated remote attackers download log archives, pull out the server's JWT signing secret, and take full administrative control.
What Is It
The vulnerability sits in Signal K Server's /skServer/ziplogs endpoint. In versions before 2.33.0, the endpoint does not require authentication, so any remote attacker who can reach the server can download its log archives. The weakness is classified as CWE-306 (Missing Authentication for Critical Function).
The archive includes security.json, which holds the server's JWT secretKey. With that key, an attacker can forge valid administrator tokens. They can then use those tokens to create persistent admin accounts and gain full control of the server.
Why It Matters
The issue is rated 9.8 CRITICAL under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The secondary CVSS 4.0 score from VulnCheck is 9.3 CRITICAL. The attack:
- Works over the network
- Is low complexity
- Needs no privileges and no user interaction
- Has a high impact on confidentiality, integrity and availability
This is a full takeover chain, not just a data leak. Once the JWT secret is exposed, the attacker can forge tokens at will and add their own admin accounts. Those accounts stay in place after the initial access, so attackers can keep control unless the secret is rotated and unauthorized accounts are removed.
As of publication, CVE-2026-118690 does not appear in the CISA Known Exploited Vulnerabilities (KEV) Catalog. The available data does not confirm active exploitation.
What's Vulnerable
- Vendor: SignalK
- Product: signalk-server (
pkg:npm/signalk-server) - Affected: all versions before 2.33.0 (semver)
- Unaffected: 2.33.0
NVD lists the record as "Received" (published 2026-10-28). No CPE data has been assigned yet.
Patch Status
The fix is in Signal K Server 2.33.0. The references include the v2.33.0 release, the fixing commit (728bab8) and GitHub security advisory GHSA-4w32-qx5g-cpwv.
Required action: Upgrade signalk-server to 2.33.0 or later. If an instance running a version before 2.33.0 was reachable over the network, assume the JWT secretKey may have been exposed. In that case, rotate the secret and check for administrator accounts you don't recognize, because forged tokens and persistent admin accounts are part of the described attack.