Review reviewCritical

CVE-2026-33950

SignalK signalk-server, signal k server

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a privilege escalation vulnerability by Admin Role Injection via /enableSecurity. An unauthenticated attacker can gain full Administrator access to the SignalK server at any time, allowing them to modify sensitive vessel routing data, alter server configurations, and access restricted endpoints. This issue has been patched in version 2.24.0-beta.4.

CVSS: 9.4
EPSS: 0.42%
CISA KEV: Not listed
Published: 2026.04.03

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.42%

Technical severityCVSS 9.4

Vulnerability overview

Affected product and versions

Product: SignalK signalk-server, signal k server
Affected versions: >= < 2.24.0-beta.4, < 2.24.0, 2.24.0
Fixed versions: 2.24.0

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that SignalK signalk-server, signal k server and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CWE: CWE-285, CWE-288, CWE-862