CVE-2026-33950

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a privilege escalation vulnerability by Admin Role Injection via /enableSecurity. An unauthenticated attacker can gain full Administrator access to the SignalK server at any time, allowing them to modify sensitive vessel routing data, alter server configurations, and access restricted endpoints. This issue has been patched in version 2.24.0-beta.4.

• CWE-285
• CWE-288
• CWE-862

• https://github.com/SignalK/signalk-server/releases/tag/v2.24.0-beta.4Product, Release Notes
• https://github.com/SignalK/signalk-server/security/advisories/GHSA-x8hc-fqv3-7gwfExploit, Vendor Advisory

Published

Apr 2, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33945Incus is a system container and virtual machine manager. Inc…9.6
• CVE-2026-33946MCP Ruby SDK is the official Ruby SDK for Model Context Prot…5.9
• CVE-2026-33947jq is a command-line JSON processor. In versions 1.8.1 and b…5.5
• CVE-2026-33948jq is a command-line JSON processor. Commits before 6374ae0b…5.3
• CVE-2026-33949Tina is a headless content management system. Prior to versi…8.1
• CVE-2026-3395A flaw has been found in MaxSite CMS up to 109.1. This impac…9.8
• CVE-2026-33951Signal K Server is a server application that runs on a centr…7.5
• CVE-2026-33952FreeRDP is a free implementation of the Remote Desktop Proto…6.5
• CVE-2026-33953LinkAce is a self-hosted archive to collect website links. V…8.5
• CVE-2026-33954LinkAce is a self-hosted archive to collect website links. I…6.5
• CVE-2026-33955Notesnook is a note-taking app. Prior to version 3.3.11 on W…8.6
• CVE-2026-3396WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable…7.5