CVE-2026-118690

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

Parameter Watch@ParameterWatch1d
⚠️ CVE-2026-118690 (9.8) ⚠️ Anyone who can reach a Signal K Server can download its log archive, pull the admin signing key out of it, and take over the server. Signal K Server before 2.33.0 is affected. Upgrade to 2.33.0 or later. https://t.co/kB6JA5XbgH
1000029
21 followersView on X

Explore more

Back to dashboard