Critical severity · published Apr 2, 2026
CVE-2026-33950
signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity
9.4
CVSS
0.4%
EPSS
No
On KEV
Description
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a privilege escalation vulnerability by Admin Role Injection via /enableSecurity. An unauthenticated attacker can gain full Administrator access to the SignalK server at any time, allowing them to modify sensitive vessel routing data, alter server configurations, and access restricted endpoints. This issue has been patched in version 2.24.0-beta.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
signalk-server · SignalK
< 2.24.0-beta.4 · source: vendor
SK
Signal K Server · Signalk
before 2.24.0; 2.24.0; 2.24.0; 2.24.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33950
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33950
Product
https://github.com/SignalK/signalk-server/releases/tag/v2.24.0-beta.4
Exploit
https://github.com/SignalK/signalk-server/security/advisories/GHSA-x8hc-fqv3-7gwf
More from signalk-server
9.8
CVE-2026-118690
Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs
9.1
CVE-2025-68620
Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling
8.8
CVE-2026-23515
RCE - Command Injection in Signal K set-system-time plugin
8.8
CVE-2025-69203
Signal K Server Vulnerable to Access Request Spoofing
8.8
CVE-2025-66398
Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)