Vulnerability · Published Apr 2, 2026 · Assigned by GitHub_M
CVE-2026-33951signalk-server: Unauthenticated Source Priorities Manipulation
Medium 6.9
In plain English
A medium-severity improper access control in signalk-server from SignalK. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.1, the SignalK Server exposes an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities. This endpoint, accessible via PUT /signalk/v1/api/sourcePriorities, does not enforce authentication or authorization checks and directly assigns user-controlled input to the server configuration. As a result, attackers can influence which GPS, AIS, or other sensor data sources are trusted by the system. The changes are immediately applied and persisted to disk, allowing the manipulation to survive server restarts. This issue has been patched in version 2.24.0-beta.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | signalk-server | 2.24.0-beta.1 | GHSA-gfmv-vh34-h2x5 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SignalK | signalk-server | < 2.24.0-beta.1 |
Weakness: CWE-284, CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N