CVE-2026-33951

High

Description

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.1, the SignalK Server exposes an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities. This endpoint, accessible via PUT /signalk/v1/api/sourcePriorities, does not enforce authentication or authorization checks and directly assigns user-controlled input to the server configuration. As a result, attackers can influence which GPS, AIS, or other sensor data sources are trusted by the system. The changes are immediately applied and persisted to disk, allowing the manipulation to survive server restarts. This issue has been patched in version 2.24.0-beta.1.

SeverityHigh

CVSS7.5

Exploit probability—

ProductSignalk Signal K Server

PublishedApr 2, 2026

First seenApr 2, 2026

Weakness typeCWE-284Improper access control CWE-306Missing authentication for critical function

How to fix

Update

signalk signal_k_server2.24.0 or later
signalk-server2.24.0-beta.1 or later

Affected products

Product	Affected versions	Fixed in
signalk signal_k_server	v < 2.24.0	2.24.0
signalk-servernpm	v < 2.24.0-beta.1	2.24.0-beta.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.