CVE-2026-33951: Unauth Source Priority Modification in SignalK Server

The core impact of CVE-2026-33951 lies in the ability of an attacker to influence the data that a vessel relies on for navigation. By manipulating the source priorities, an attacker could elevate the trust level of malicious or inaccurate data sources (e.g., spoofed GPS signals, compromised AIS transponders) while demoting legitimate ones. This could lead to incorrect course plotting, collision avoidance failures, and ultimately, dangerous navigational errors. The persistence of these changes to disk means that even a server restart won't undo the attacker's modifications, ensuring continued influence. The blast radius extends to any system relying on the compromised SignalK Server for navigation data, potentially impacting multiple vessels and individuals.

1. Reserved2026-03-24
2. Published2026-04-03
3. Modified2026-04-06
4. EPSS updated2026-04-10

The primary mitigation for CVE-2026-33951 is to upgrade SignalK Server to version 2.24.0-beta.1 or later. Prior to upgrading, consider creating a backup of your existing SignalK configuration to facilitate a rollback if the upgrade introduces unforeseen compatibility issues. As a temporary workaround, consider implementing network-level restrictions to limit access to the /signalk/v1/api/sourcePriorities endpoint. This could involve using a Web Application Firewall (WAF) or proxy server to block unauthorized requests. Additionally, monitor your SignalK server logs for any unusual activity related to source priority changes. After upgrading, confirm the fix by verifying that unauthorized attempts to modify source priorities are rejected and that the system is using the expected data sources.