---
id: CVE-2026-55591
title: Signal K Server is a server application that runs on a central hub in a boat
summary: >-
  Signal K Server is a server application that runs on a central hub in a boat.
  Prior to 2.28.0, makeRemoteRequest() in src/serverroutes.ts accepted
  attacker-controlled host, port, useTLS, and selfsignedcert parameters from the
  testSignalK…
severity: medium
cvss: 5.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N'
cwe:
  - CWE-918
vendor: SignalK
product: signalk-server
affected:
  - signalk-server < 2.28.0
patched:
  - signalk-server 2.28.0
published: '2026-09-15'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T18:17:24.213'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55591'
references:
  - url: >-
      https://github.com/SignalK/signalk-server/commit/2816b0dda1bdde893d85c969a9c5950e7825eee7
    label: security-advisories@github.com
  - url: 'https://github.com/SignalK/signalk-server/releases/tag/v2.28.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/SignalK/signalk-server/security/advisories/GHSA-q59x-jc9f-gfqf
    label: security-advisories@github.com
  - url: >-
      https://github.com/SignalK/signalk-server/security/advisories/GHSA-q59x-jc9f-gfqf
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-q59x-jc9f-gfqf'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - npm
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-15T17:23:28.984905Z'
ecosystem: npm
ingestedAt: '2026-06-19T03:39:00.762Z'
epss: 0.00298
epssPercentile: 0.20021
---

## Overview

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest() in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints without validating the destination. When security was not configured, addAdminMiddleware() was a no-op in dummysecurity.ts, leaving all three endpoints accessible without authentication. The server could be forced to contact loopback, private, link-local, cloud metadata, or arbitrary external destinations, and selfsignedcert could disable certificate verification for outbound HTTPS requests. The checkAccessRequest endpoint also interpolated requestId into its destination path, allowing traversal to other paths on the selected host. Distinct success, connection-refused, and timeout responses enabled internal port scanning; returned response bodies enabled cloud metadata and internal-service data exfiltration; requestAccess enabled server-side POST requests with attacker-controlled JSON; and access to cluster-internal services could support lateral movement. This issue is fixed in version 2.28.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55591)

Affected packages:

- `signalk-server <= 2.27.0`

Patched in:

- `signalk-server 2.28.0`

Source: https://github.com/advisories/GHSA-q59x-jc9f-gfqf