CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2025-69203

Mutiny on the Bridge: The Signal K Deception (CVE-2025-69203)

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 2, 2026·6 min read·24 visits

Executive Summary (TL;DR)

Signal K Server < 2.19.0 contains a 'Social Engineering Helper Kit' vulnerability. By blindly trusting `X-Forwarded-For` headers and hiding actual permission levels in the Admin UI, it allows attackers to masquerade as local, harmless devices (like a depth sensor) while secretly requesting—and receiving—full Admin access from an unsuspecting captain.

A sophisticated social engineering vulnerability in Signal K Server allowing attackers to spoof trusted IPs, mask administrative permission requests behind benign descriptions, and leverage information leaks to trick administrators into granting full control.

Official Patches

Signal KSignal K Server v2.19.0 Release Notes

Fix Analysis (1)

Technical Appendix

CVSS Score
6.3/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Probability
0.10%
Top 100% most exploited
2,500
via Shodan

Affected Systems

Signal K Server (Node.js)

Affected Versions Detail

Product
Affected Versions
Fixed Version
Signal K Server
Signal K
< 2.19.02.19.0
AttributeDetail
CVE IDCVE-2025-69203
CVSS6.3 (Medium)
Attack VectorNetwork (AV:N)
User InteractionRequired (UI:R)
ImpactPrivilege Escalation / Admin Access
Key WeaknessCWE-290 (IP Spoofing) & CWE-451 (UI Misrepresentation)

MITRE ATT&CK Mapping

T1190Exploit Public-Facing Application
Initial Access
T1036Masquerading
Defense Evasion
T1566Phishing
Initial Access
CWE-290
Authentication Bypass by Spoofing

Authentication Bypass by Spoofing

Known Exploits & Detection

TheoreticalSocial Engineering vector requiring network access and admin interaction.

Vulnerability Timeline

Vulnerability Discovered
2025-01-10
Patch Developed (v2.19.0)
2025-01-15
Public Disclosure
2025-01-18

References & Sources

  • [1]Signal K Security Advisories

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•about 14 hours ago•CVE-2026-12243
7.5

CVE-2026-12243: Incomplete Path Traversal Validation and Percent-Encoding Bypass in NLTK

CVE-2026-12243 is a path traversal vulnerability in the Natural Language Toolkit (NLTK) version 3.9.4. The flaw exists because the input validation routine fails to account for percent-encoded directory traversal sequences like '..%2f' before passing them to urllib.request.url2pathname(), which decodes them into active traversal sequences.

Amit Schendel
Amit Schendel
3 views•8 min read
•about 15 hours ago•CVE-2026-73654
8.5

CVE-2026-73654: Prototype Pollution in Trigger.dev leading to Cascading Denial of Service

CVE-2026-73654 is a high-severity prototype pollution vulnerability in Trigger.dev. The flaw occurs during the handling of run-metadata updates through the PUT /api/v1/runs/:runId/metadata endpoint. Because user-supplied keys are parsed directly by the @jsonhero/path library without sanitization, an authenticated attacker with low privileges can pollute the global Object.prototype. This causes database queries via Prisma ORM to fail validation and induces unhandled exceptions in the Prometheus metrics client, resulting in a process-wide denial of service.

Alon Barad
Alon Barad
8 views•6 min read
•about 17 hours ago•CVE-2026-73559
6.5

CVE-2026-73559: Uncontrolled Resource Consumption in vLLM API completions

CVE-2026-73559 is an uncontrolled resource consumption vulnerability in the vLLM engine, specifically within the /v1/completions API endpoint, allowing authenticated attackers to cause application-level denial of service via unbounded prompt arrays.

Amit Schendel
Amit Schendel
8 views•5 min read
•about 19 hours ago•CVE-2026-54526
9.9

CVE-2026-54526: Strict Template Referencing Bypass and Privilege Escalation in Argo Workflows

A critical security bypass vulnerability in Argo Workflows allows authenticated attackers with workflow submission privileges to bypass 'Strict' or 'Secure' template referencing restrictions. By injecting unvalidated fields into the nested ArtifactGC configuration, attackers can execute arbitrary pod patches, leading to host namespace escape and cluster-wide privilege escalation.

Alon Barad
Alon Barad
14 views•6 min read
•about 20 hours ago•CVE-2026-54249
6.8

CVE-2026-54249: Server-Side Request Forgery via Confused Deputy in Pydantic AI UI Adapters

A Server-Side Request Forgery (SSRF) / Confused Deputy vulnerability has been identified in Pydantic AI UI Adapters (such as VercelAIAdapter). Under certain conditions, a malicious client can supply manipulated message history with provider metadata that forces the server to resolve files within privileged cloud environments (AWS S3, Google Cloud Storage) or model providers. This occurs because the adapters deserialize client-provided metadata structures directly into UploadedFile instances without validation, which are subsequently fetched using high-privilege server credentials.

Alon Barad
Alon Barad
7 views•7 min read
•about 21 hours ago•GHSA-RM43-82J9-R4MJ
8.2

GHSA-RM43-82J9-R4MJ: Path Traversal (Arbitrary File Read) in atomic-agents-stack Dashboard

A path traversal vulnerability in the optional dashboard server of atomic-agents-stack before version 1.1.0 allows unauthenticated remote attackers to read arbitrary files from the host filesystem.

Amit Schendel
Amit Schendel
6 views•6 min read