CVE-2026-55591

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest() in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints without validating the destination. When security was not configured, addAdminMiddleware() was a no-op in dummysecurity.ts, leaving all three endpoints accessible without authentication. The server could be forced to contact loopback, private, link-local, cloud metadata, or arbitrary external destinations, and selfsignedcert could disable certificate verification for outbound HTTPS requests. The checkAccessRequest endpoint also interpolated requestId into its destination path, allowing traversal to other paths on the selected host. Distinct success, connection-refused, and timeout responses enabled internal port scanning; returned response bodies enabled cloud metadata and internal-service data exfiltration; requestAccess enabled server-side POST requests with attacker-controlled JSON; and access to cluster-internal services could support lateral movement. This issue is fixed in version 2.28.0.

• CWE-918

• https://github.com/SignalK/signalk-server/commit/2816b0dda1bdde893d85c969a9c5950e7825eee7
• https://github.com/SignalK/signalk-server/releases/tag/v2.28.0
• https://github.com/SignalK/signalk-server/security/advisories/GHSA-q59x-jc9f-gfqf
• https://github.com/SignalK/signalk-server/security/advisories/GHSA-q59x-jc9f-gfqf

Published

Sep 15, 2026

Last Modified

Sep 15, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55584phpSysInfo is a customizable PHP script that displays system…7.5
• CVE-2026-55585QWED is open-source AI verification infrastructure for deter…8.8
• CVE-2026-55586SumatraPDF is a multi-format reader for Windows. In 3.6.1 an…6.6
• CVE-2026-55588ORAS (OCI Registry As Storage) is a CLI and library for mana…6.5
• CVE-2026-5559A vulnerability has been found in AntaresMugisho PyBlade 0.1…6.3
• CVE-2026-55590CakePHP Authentication is an authentication plugin for CakeP…6.1
• CVE-2026-55592Dashy is a self-hostable personal dashboard. Prior to 4.3.7,…3.9
• CVE-2026-55593Froxlor is open source server administration software. Prior…6.5
• CVE-2026-55594ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-55595ImageMagick is free and open-source software used for editin…4.7
• CVE-2026-55596Plate is a rich-text editor with AI and shadcn/ui. From 53.0…8.7
• CVE-2026-55597ImageMagick is free and open-source software used for editin…5.5