CVE-2026-55591
Received Received - Intake

Signal K Server Remote Code Execution via Unauthenticated API Endpoints

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest() in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints without validating the destination. When security was not configured, addAdminMiddleware() was a no-op in dummysecurity.ts, leaving all three endpoints accessible without authentication. The server could be forced to contact loopback, private, link-local, cloud metadata, or arbitrary external destinations, and selfsignedcert could disable certificate verification for outbound HTTPS requests. The checkAccessRequest endpoint also interpolated requestId into its destination path, allowing traversal to other paths on the selected host. Distinct success, connection-refused, and timeout responses enabled internal port scanning; returned response bodies enabled cloud metadata and internal-service data exfiltration; requestAccess enabled server-side POST requests with attacker-controlled JSON; and access to cluster-internal services could support lateral movement. This issue is fixed in version 2.28.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-55591
EUVD
EUVD-2026-78677

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
signal_k server 2.28.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55591 is a Server-Side Request Forgery (SSRF) vulnerability in SignalK Server versions up to 2.27.0. It affects three administrative endpoints used for remote server connection management. The vulnerability allows attackers to control parameters like host, port, useTLS, and selfsignedcert without validation, forcing the server to make arbitrary HTTP/HTTPS requests to unintended destinations such as internal networks, cloud metadata services, or loopback addresses. The selfsignedcert parameter can disable TLS verification, enabling man-in-the-middle attacks. The checkAccessRequest endpoint is also vulnerable to path traversal due to requestId interpolation.

Detection Guidance

Check if your SignalK Server version is below 2.28.0 by running: signal-k-server --version. Inspect network logs for outbound requests to unexpected destinations like loopback, private IPs, or cloud metadata services (169.254.169.254). Monitor for unauthorized access to endpoints like /testSignalKConnection, /requestAccess, or /checkAccessRequest.

Impact Analysis

This vulnerability can allow attackers to scan internal networks, exfiltrate cloud metadata (including IAM credentials), access internal services, or interact with internal APIs. It enables lateral movement within a network by forcing the server to make requests to cluster-internal services. Attackers can also send server-side POST requests with attacker-controlled JSON via the requestAccess endpoint. Distinct error responses may reveal internal network topology.

Mitigation Strategies

Upgrade SignalK Server to version 2.28.0 or later immediately. If upgrading is not possible, disable the vulnerable endpoints by enabling authentication in dummysecurity.ts. Block outbound requests to sensitive IP ranges at the firewall level as a temporary measure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55591. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart