{"id":"CVE-2026-118690","aliases":["GHSA-4w32-qx5g-cpwv"],"url":"https://o3.security/vulnerability/CVE-2026-118690","summary":"Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs","details":"Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.","published":"2026-10-28T21:11:17.919Z","modified":"2026-10-30T02:46:58.684008137Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/SignalK/signalk-server/commit/728bab82742d16c54e50525b95dc9b6e32396107","label":"SignalK/signalk-server@728bab8"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118690.json"},{"type":"ADVISORY","url":"https://github.com/SignalK/signalk-server/releases/tag/v2.33.0"},{"type":"ADVISORY","url":"https://github.com/SignalK/signalk-server/security/advisories/GHSA-4w32-qx5g-cpwv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118690"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/signal-k-server-before-2.33.0-missing-authentication-via-skserver-ziplogs"},{"type":"FIX","url":"https://github.com/SignalK/signalk-server/commit/728bab82742d16c54e50525b95dc9b6e32396107"},{"type":"PACKAGE","url":"https://github.com/SignalK/signalk-server"},{"type":"ARTICLE","url":"https://github.com/SignalK/signalk-server/blob/v2.32.0/src/interfaces/logfiles.js#L30-L91"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-30T02:46:58.684008137Z"}}