Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints (CVE-2026-55591) | HOL Guard CVE

Medium severityCVE-2026-55591GHSA-Q59X-JC9F-GFQF

Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

Answer in brief

CVE-2026-55591 records a Medium severity vulnerability in Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints. The current sources do not mark it as known exploited. The current feed maps SignalK/signalk-server (generic), signalk-server (npm). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 15, 2026Updated Sep 15, 2026Source checked Sep 17, 2026First seen by HOL Jun 19, 2026Material review Sep 15, 2026

Upstream Advisory

Key facts

Risk: Medium
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps SignalK/signalk-server (generic), signalk-server (npm). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
SignalK/signalk-servergeneric	< 2.28.0	Not reported
signalk-servernpm	<=2.27.0	2.28.0

Recommended response

Check inventory. Check lockfiles and deployed manifests for SignalK/signalk-server, signalk-server.
Review the reported fix. Update signalk-server to 2.28.0 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Jun 19, 2026

Sources and claim methodology

Upstream source description

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest() in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints without validating the destination. When security was not configured, addAdminMiddleware() was a no-op in dummysecurity.ts, leaving all three endpoints accessible without authentication. The server could be forced to contact loopback, private, link-local, cloud metadata, or arbitrary external destinations, and selfsignedcert could disable certificate verification for outbound HTTPS requests. The checkAccessRequest endpoint also interpolated requestId into its destination path, allowing traversal to other paths on the selected host. Distinct success, connection-refused, and timeout responses enabled internal port scanning; returned response bodies enabled cloud metadata and internal-service data exfiltration; requestAccess enabled server-side POST requests with attacker-controlled JSON; and access to cluster-internal services could support lateral movement. This issue is fixed in version 2.28.0.

Quoted source text, attributed separately from HOL analysis.