Critical · published January 1, 2026
🚨 An unauthenticated attacker can take control of your boat's Signal K Server with just a simple request! This means they could overwrite crucial configuration files and execute arbitrary code. 🔥 Think of it like a thief sneaking into the captain's quarters and messing with the navigation system. If they can change the settings, they can steer the entire ship wherever they want, potentially putting everyone on board in serious danger. This vulnerability could lead to a devastating situation where an attacker hijacks the administrator's 'Restore' functionality. This means they could overwrite critical files like `security.json` and `package.json`, allowing for account takeover and even full Remote Code Execution (RCE). That's a nightmare scenario for any boat owner!
Think of it like a thief sneaking into the captain's quarters and messing with the navigation system. If they can change the settings, they can steer the entire ship wherever they want, potentially putting everyone on board in serious danger. Prior to version 2.19.0, Signal K Server has a flaw in the `/skServer/validateBackup` endpoint that allows an unauthenticated attacker to manipulate the internal server state, compromising its functionality and security.
This vulnerability could lead to a devastating situation where an attacker hijacks the administrator's 'Restore' functionality. This means they could overwrite critical files like `security.json` and `package.json`, allowing for account takeover and even full Remote Code Execution (RCE). That's a nightmare scenario for any boat owner! Update your Signal K Server to version 2.19.0 immediately to patch this critical vulnerability. Review your server's configurations and implement strict access controls to prevent unauthorized access. Don't forget to audit your security settings for any anomalies! You've got this! With these steps, you'll be securing your Signal K Server in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| signalk/signal_k_server | < 2.19.0 | 2.19.0 |