CVE-2026-55591: Signal K Server SSRF Vulnerability

CVE-2026-55591 Overview

CVE-2026-55591 is a Server-Side Request Forgery (SSRF) vulnerability in Signal K Server, a server application that runs on a central hub in a boat. Versions prior to 2.28.0 accept attacker-controlled host, port, useTLS, and selfsignedcert parameters through the testSignalKConnection, requestAccess, and checkAccessRequest endpoints without validating the destination. When security is not configured, addAdminMiddleware() acts as a no-op, exposing the endpoints without authentication. The flaw is tracked as CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated attackers can force the server to contact loopback, private, link-local, and cloud metadata endpoints, enabling internal port scanning, data exfiltration, and lateral movement into cluster-internal services.

Affected Products

Signal K Server versions prior to 2.28.0
Deployments where security is not configured (dummy security module active)
Signal K Server instances exposing testSignalKConnection, requestAccess, or checkAccessRequest endpoints

Discovery Timeline

2026-09-15 - CVE-2026-55591 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-55591

Vulnerability Analysis

The vulnerability resides in the makeRemoteRequest() function in src/serverroutes.ts. The function accepts destination parameters directly from HTTP request bodies without validation. Attackers control the outbound request target, TLS behavior, and path segments.

Three endpoints reach this function: testSignalKConnection performs a connection probe, requestAccess issues a POST request with attacker-supplied JSON, and checkAccessRequest interpolates a requestId into the destination path. Each endpoint returns distinct responses for success, connection-refused, and timeout conditions, which enables internal port scanning.

Response bodies flow back to the caller, allowing extraction of cloud metadata (for example, from 169.254.169.254) and internal-service data. The selfsignedcert parameter disables certificate verification for outbound HTTPS requests, defeating TLS trust decisions. The checkAccessRequest path interpolation permits traversal to arbitrary paths on the selected host.

Root Cause

The root cause is missing input validation on network destination parameters combined with a broken authentication gate. addAdminMiddleware() in dummysecurity.ts is a no-op when security is not configured, leaving the three endpoints reachable without credentials. No allowlist or block-list controls constrained the outbound host, port, protocol, or path.

Attack Vector

An unauthenticated remote attacker sends HTTP requests to the exposed endpoints with a chosen host and port. The server issues outbound requests to those destinations and returns response data or timing signals to the attacker. This enables reconnaissance of internal networks, exfiltration from cloud metadata services, and server-side POST requests carrying attacker-controlled JSON to internal APIs.

typescript

// Security patch: src/ssrfGuard.ts (added in v2.28.0)
import { BlockList, isIP, LookupFunction } from 'node:net'
import dns from 'node:dns'

// Special-use destinations that the remote-connection endpoints must never
// reach. These are not valid Signal K peers and are the SSRF targets of value:
// the cloud metadata service (169.254.169.254), loopback-bound services, and
// other non-routable ranges.
const blockedRanges = new BlockList()
blockedRanges.addSubnet('0.0.0.0', 8, 'ipv4')      // "this host" / this-network
blockedRanges.addSubnet('127.0.0.0', 8, 'ipv4')    // loopback
blockedRanges.addSubnet('169.254.0.0', 16, 'ipv4') // link-local incl. cloud metadata
blockedRanges.addSubnet('224.0.0.0', 4, 'ipv4')    // multicast

Source: GitHub Commit 2816b0d

The patch also adds a schema in src/remoteConnectionSchemas.ts that enforces UUID format on requestId to prevent path traversal, and validates port strings against the 1-65535 range.

Detection Methods for CVE-2026-55591

Indicators of Compromise

Outbound HTTP or HTTPS connections from the Signal K Server host to 127.0.0.0/8, 169.254.169.254, or other link-local addresses
HTTP access logs showing repeated requests to /testSignalKConnection, /requestAccess, or /checkAccessRequest with varying host and port parameters
Outbound TLS connections initiated with certificate verification disabled (selfsignedcert=true)
Requests to checkAccessRequest containing non-UUID requestId values or path traversal sequences

Detection Strategies

Monitor Signal K Server access logs for unauthenticated calls to the three vulnerable endpoints
Alert on outbound connections from the Signal K Server process to cloud metadata IPs or internal management ports
Inspect request bodies for host parameters resolving to private, loopback, or link-local ranges
Correlate short-interval bursts of testSignalKConnection requests targeting sequential ports as scanning behavior

Monitoring Recommendations

Enable network egress logging on the host running Signal K Server and forward to a centralized log store
Track process-level outbound connection telemetry to detect unexpected destinations from the Node.js runtime
Establish a baseline of legitimate remote Signal K peer connections and alert on deviations

How to Mitigate CVE-2026-55591

Immediate Actions Required

Upgrade Signal K Server to version 2.28.0 or later, which introduces the ssrfGuard module and strict schema validation
Configure the Signal K security module so addAdminMiddleware() enforces authentication on administrative endpoints
Restrict network egress from the Signal K Server host to only required Signal K peers
Audit access logs for prior exploitation attempts against the three affected endpoints

Patch Information

The fix is available in Signal K Server v2.28.0. See the GitHub Release v2.28.0 and the GitHub Security Advisory GHSA-q59x-jc9f-gfqf. The patch commit 2816b0d adds destination validation, a UUID schema for requestId, and a numeric port range check.

Workarounds

Place the Signal K Server behind a reverse proxy that blocks unauthenticated access to /testSignalKConnection, /requestAccess, and /checkAccessRequest
Apply host-based firewall rules preventing outbound connections to 127.0.0.0/8, 169.254.0.0/16, and cloud metadata endpoints
Enable Signal K security configuration to activate real authentication middleware in place of the dummy module

bash

# Example iptables rules to block SSRF-relevant egress destinations
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -d 169.254.0.0/16 -j DROP
iptables -A OUTPUT -d 224.0.0.0/4 -j DROP