CVE-2026-115752 SignalK CVE debrief

Who should care

Defenders responsible for Signal K Server instances, especially those exposed to untrusted networks or handling sensitive data, should assess their exposure and prioritize verification and updates.

Why it matters

The CVE-2026-115752 vulnerability in Signal K Server allows attackers to make unauthorized requests to sensitive endpoints, potentially leading to data breaches or system compromise. Defenders should prioritize verification and updates to prevent exploitation.

• Potential unauthorized access to sensitive data or systems
• Possible disruption of server operations or data integrity
• Need for verification and updates to prevent exploitation
• Potential for attackers to gather information about server environments

Technical summary

The Signal K Server from version 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher. This vulnerability allows attackers publishing npm packages with Signal K keywords to make servers request loopback, vessel network, or cloud metadata endpoints. The responses from these requests are stored and served back via the admin UI. Defenders should prioritize verifying and updating Signal K Server instances to version 2.34.0 or later, especially those exposed to untrusted networks or handling sensitive data, to prevent potential unauthorized access to sensitive data or systems.

Defensive priority

Defenders should prioritize verifying and updating Signal K Server instances to version 2.34.0 or later, especially those exposed to untrusted networks or handling sensitive data.

Recommended defensive actions

• Verify and update Signal K Server instances to version 2.34.0 or later
• Restrict access to the admin UI to trusted users and networks
• Monitor server requests and responses for potential SSRF activity
• Review and update npm package management and publishing processes to prevent exploitation
• Confirm whether affected Signal K Server deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was reported in the CVE Program record and detailed in the NVD vulnerability database. The source item provides additional context on the vulnerability, including affected versions and potential impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.