CVE-2026-33951
Unauthenticated PUT Allows Navigation Data Manipulation in Signal K Server
Publication date: 2026-04-02
Last updated on: 2026-04-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| signalk | signal_k_server | to 2.24.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-33951 is a vulnerability in the SignalK Server application, which runs on a central hub in a boat. Before version 2.24.0-beta.1, the server exposes an unauthenticated HTTP PUT endpoint at /signalk/v1/api/sourcePriorities that allows remote attackers to modify navigation data source priorities.
This endpoint does not enforce any authentication or authorization checks and directly assigns user-controlled input to the server's configuration settings. Attackers can send arbitrary JSON data to change which GPS, AIS, or other sensor data sources the system trusts.
The changes are applied immediately and saved to disk, persisting even after server restarts. This means attackers can manipulate the navigation data sources the system relies on without any restrictions.
How can this vulnerability impact me? :
This vulnerability allows unauthorized remote attackers to manipulate the priorities of navigation data sources used by the SignalK Server.
- Attackers can cause the system to trust incorrect or malicious GPS, AIS, or other sensor data.
- Such manipulation can lead to incorrect navigation information being used, potentially compromising the safety and operation of the boat.
- Because the changes persist after server restarts, the impact can be long-lasting until the system is patched or restored.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring network traffic for unauthenticated HTTP PUT requests to the endpoint /signalk/v1/api/sourcePriorities or /skServer/sourcePriorities. Such requests indicate attempts to modify navigation data source priorities without authentication.
You can use network monitoring tools like tcpdump or Wireshark to capture and filter HTTP PUT requests to these endpoints.
- Example tcpdump command to detect such requests: tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'PUT /signalk/v1/api/sourcePriorities'
- Alternatively, use curl or similar tools to test if the endpoint is accessible without authentication by sending a PUT request and observing the response.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the SignalK Server to version 2.24.0-beta.1 or later, where this vulnerability has been patched.
Until the upgrade can be performed, restrict network access to the SignalK Server to trusted users only, for example by firewall rules or network segmentation, to prevent unauthorized access to the vulnerable endpoint.
Additionally, monitor and audit any changes to the navigation data source priorities configuration to detect unauthorized modifications.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated remote attackers to manipulate navigation data source priorities by exploiting an exposed HTTP endpoint without authentication or authorization. This unauthorized access to critical configuration settings could lead to trust in incorrect or malicious sensor data.
While the CVE description and resources do not explicitly mention compliance with standards such as GDPR or HIPAA, the lack of authentication and control over critical system configuration could potentially violate security requirements in these regulations, which mandate protection of data integrity and access controls.
Therefore, this vulnerability may negatively impact compliance with common standards and regulations that require strict access control and data integrity protections.