Leaking the Bilge: Signal K Server Unauthenticated Info Disclosure
Jan 2, 2026·5 min read·2 visits
Executive Summary (TL;DR)
Versions of Signal K Server prior to 2.19.0 allow unauthenticated access to sensitive diagnostic endpoints. Attackers can map serial ports, view the full server data schema, and fingerprint installed analyzers due to a missing authorization check in the application's middleware routing logic.
Signal K Server, the open-source nervous system for modern connected boats, suffered from a classic 'fail-open' security architecture. By forgetting to manually whitelist three API endpoints in a centralized security file, developers inadvertently exposed system internals and hardware configurations to unauthenticated remote attackers.
Official Patches
Fix Analysis (1)
Technical Appendix
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NAffected Systems
Affected Versions Detail
| Product | Affected Versions | Fixed Version |
|---|---|---|
Signal K Server Signal K | < 2.19.0 | 2.19.0 |
| Attribute | Detail |
|---|---|
| CWE ID | CWE-200 |
| Attack Vector | Network |
| CVSS Score | 5.3 |
| Impact | Information Disclosure |
| Patch Commit | ead2a03d8994969cafcca0320abee16f0e66e7a9 |
| Exploit Status | PoC Available |
MITRE ATT&CK Mapping
Exposure of Sensitive Information to an Unauthorized Actor
Known Exploits & Detection
Vulnerability Timeline
Subscribe to updates
Get the latest CVE analysis reports delivered to your inbox.