CVE-2026-115752 Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-115752?
CVE-2026-115752 is a low-severity vulnerability in signalk-server, published on 23 Oct 2026.
Official description
Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud metadata endpoints, storing image-typed responses served back via the admin UI.
Weakness: CWE-918
Which versions are affected by CVE-2026-115752?
How do I fix CVE-2026-115752?
No fix has been published for CVE-2026-115752 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-115752 being exploited?
There is no known exploitation of CVE-2026-115752 in the wild and no public exploit code.
Sources
Also known as GHSA-7wpf-ch8f-5f4x, GHSA-rjvc-ghm7-354c.