Vulnerability · Published Oct 23, 2026 · Assigned by VulnCheck

CVE-2026-115752Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon

Medium 4.2

In plain English

A medium-severity server-side request forgery in signalk-server from SignalK. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.2%top 93.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud metadata endpoints, storing image-typed responses served back via the admin UI.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	signalk-server	2.34.0	GHSA-7wpf-ch8f-5f4x

Affected products (as reported)

Vendor	Product	Versions
SignalK	signalk-server	2.28.0-beta.2 – before 2.34.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-7wpf-ch8f-5f4x) vendor-advisory
https://github.com/SignalK/signalk-server/commit/535104f655304c697d535252da397948e5101dc6 patch
signalk-server v2.34.0 Release Notes release-notes
VulnCheck Advisory: Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon third-party-advisory