Zero Radar
← feed
CriticalVulnerabilityGHSA-4xm8-rg9h-jhq2updated 30 Oct 2026, 22:58 UTC

Signal K server lets anyone read and overwrite server files, leading to full takeover

Someone who can reach the server without a login can trick it into handing over its secret signing key. With that key they can make themselves an admin and run commands on the machine.

Fix available · out Official source
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yessignalk-server 2.34.0; @signalk/resources-provider 1.5.3 · since 30 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Anonymous attackerNo login needed when read access is on
  2. 2Traversal requestEncoded ../ escapes the resources folder
  3. 3Secret key readsecurity.json exposes the JWT signing secret
  4. 4Admin token forgedAttacker signs their own admin JWT
  5. 5Command executionExecute provider runs shell commands
  6. ResultAttacker controls the server

What happened

A path traversal flaw in the Signal K resources API allows reading, writing and deleting files outside the storage directory, including the JWT signing secret in security.json, which enables admin token forgery and remote code execution via the Execute provider type.

Why it is dangerous: An attacker can take complete control of the Signal K server and the machine it runs on, including data and boat or device systems that rely on it. Anyone running a networked Signal K server is at risk, most seriously where anonymous read access is enabled.

Are you affected?

You are affected if you run signalk-server 2.0.0 up to (not including) 2.34.0, or @signalk/resources-provider 1.0.0 up to (not including) 1.5.3, especially with allow_readonly enabled.

Package / productAffected versionsFixed in
signalk-server · npm>= 2.0.0, < 2.34.02.34.0
@signalk/resources-provider · npm>= 1.0.0, < 1.5.31.5.3

What to do

  1. Update signalk-server to 2.34.0 or later
  2. Update @signalk/resources-provider to 1.5.3 or later
  3. Turn off allow_readonly if it is not needed, and restrict network access to the server
  4. Rotate the JWT signing secret and review settings.json for unexpected Execute providers if the server was exposed

Timeline

  1. 30 Oct 2026, 22:57 UTC
    Publicly disclosed
  2. 30 Oct 2026, 22:57 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 30 Oct 2026, 22:58 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
GHSA-4xm8-rg9h-jhq2
CVSS
9.8 / 10
Disclosed
30 Oct 2026, 22:57 UTC
On Zero Radar
30 Oct 2026, 22:58 UTC (1 min after disclosure)
Last change
30 Oct 2026, 22:58 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Signal K server lets anyone read and overwrite server files, leading to full takeover · Zero Radar