CVE-2026-33951: Signal K Server: Unauthenticated Source Priorities Manipulation

April 3, 2026 (updated April 6, 2026)

The SignalK Server exposes an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities. This endpoint, accessible via PUT /signalk/v1/api/sourcePriorities, does not enforce authentication or authorization checks and directly assigns user-controlled input to the server configuration.

As a result, attackers can influence which GPS, AIS, or other sensor data sources are trusted by the system. The changes are immediately applied and persisted to disk, allowing the manipulation to survive server restarts.

References

github.com/SignalK/signalk-server
github.com/SignalK/signalk-server/releases/tag/v2.24.0-beta.1
github.com/SignalK/signalk-server/security/advisories/GHSA-gfmv-vh34-h2x5
github.com/advisories/GHSA-gfmv-vh34-h2x5
nvd.nist.gov/vuln/detail/CVE-2026-33951

Code Behaviors & Features

Detect and mitigate CVE-2026-33951 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →