{"id":"CVE-2026-118690","published":"2026-10-28T22:17:13Z","modified":"2026-10-29T18:17:28Z","title":"Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote…","vendor":"SignalK","product":"signalk-server","tier":"core","eol":null,"description":{"text":"Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.","provenance":"source","from":"NVD"},"summary":{"text":"Signal K Server versions before 2.33.0 have a missing authentication flaw in the server's /skServer/ziplogs endpoint, which is the component that serves log archives. A remote attacker with only network access to the server and no credentials can download those log archives, and the flaw lets them obtain the JWT signing secret from the security configuration inside the archive, forge administrator tokens, and create persistent admin accounts for full control of the server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:25:31Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00688,"percentile":0.52685,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":2,"pulses":[{"name":"Known_Cve | Oct 31, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ae4af06a3790b65a9afe87a","created":"2026-10-30"},{"name":"Known_Cve | Oct 30, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ae35d945cba1d70e2bf3a79","created":"2026-10-29"}],"provenance":"machine"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://github.com/SignalK/signalk-server","tags":[]},{"url":"https://github.com/SignalK/signalk-server/blob/v2.32.0/src/interfaces/logfiles.js#L30-L91","tags":[]},{"url":"https://github.com/SignalK/signalk-server/commit/728bab82742d16c54e50525b95dc9b6e32396107","tags":[]},{"url":"https://github.com/SignalK/signalk-server/releases/tag/v2.33.0","tags":[]},{"url":"https://github.com/SignalK/signalk-server/security/advisories/GHSA-4w32-qx5g-cpwv","tags":[]},{"url":"https://www.vulncheck.com/advisories/signal-k-server-before-2.33.0-missing-authentication-via-skserver-ziplogs","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-112491","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112491","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-28","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118690","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":18.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":10.54,"detail":"percentile 0.5269"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}