CVE-2026-33950 CRITICAL

CVE-2026-33950: signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity

Vendor Signalk
Product signalk-server
Weakness CWE-285
Published April 2, 2026
Last update April 3, 2026
View on NVD All CVEs

CVSS base score

9.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

What the vulnerability does

01Description

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a privilege escalation vulnerability by Admin Role Injection via /enableSecurity. An unauthenticated attacker can gain full Administrator access to the SignalK server at any time, allowing them to modify sensitive vessel routing data, alter server configurations, and access restricted endpoints. This issue has been patched in version 2.24.0-beta.4.

Key dates

02Disclosure timeline

April 2, 2026 CVE published
April 3, 2026 Record updated