CVE-2026-33951

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.1, the SignalK Server exposes an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities. This endpoint, accessible via PUT /signalk/v1/api/sourcePriorities, does not enforce authentication or authorization checks and directly assigns user-controlled input to the server configuration. As a result, attackers can influence which GPS, AIS, or other sensor data sources are trusted by the system. The changes are immediately applied and persisted to disk, allowing the manipulation to survive server restarts. This issue has been patched in version 2.24.0-beta.1.

• CWE-284
• CWE-306

• https://github.com/SignalK/signalk-server/releases/tag/v2.24.0-beta.1Product, Release Notes
• https://github.com/SignalK/signalk-server/security/advisories/GHSA-gfmv-vh34-h2x5Vendor Advisory

Published

Apr 2, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33946MCP Ruby SDK is the official Ruby SDK for Model Context Prot…5.9
• CVE-2026-33947jq is a command-line JSON processor. In versions 1.8.1 and b…5.5
• CVE-2026-33948jq is a command-line JSON processor. Commits before 6374ae0b…5.3
• CVE-2026-33949Tina is a headless content management system. Prior to versi…8.1
• CVE-2026-3395A flaw has been found in MaxSite CMS up to 109.1. This impac…9.8
• CVE-2026-33950Signal K Server is a server application that runs on a centr…9.4
• CVE-2026-33952FreeRDP is a free implementation of the Remote Desktop Proto…6.5
• CVE-2026-33953LinkAce is a self-hosted archive to collect website links. V…8.5
• CVE-2026-33954LinkAce is a self-hosted archive to collect website links. I…6.5
• CVE-2026-33955Notesnook is a note-taking app. Prior to version 3.3.11 on W…8.6
• CVE-2026-3396WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable…7.5
• CVE-2026-33975Twenty is an open source CRM built with NestJS (Node.js). In…8.3