Signal K Server — CVE-2026-118690 (Critical)

Date Oct 28, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Signal · K Server

CVE CVE-2026-118690

Critical vendor advisory CVE-2026-118690

Summary

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in Signal K Server. Patch or mitigate promptly. EPSS percentile: 53%.

Operator check

Review CVE-2026-118690 in your asset inventory. Apply patches per vendor guidance and verify K Server is not exposed. CVSS score: 9.8. EPSS probability: 0.7%; percentile: 53%.

Sources

NVD — CVE-2026-118690 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed