CVE-2026-35038 signalk-server: Arbitrary Prototype Read via `from` Field Bypass

What is CVE-2026-35038?

CVE-2026-35038 is a low-severity vulnerability in signalk-server, published on 2 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, there is an arbitrary prototype read vulnerability via `from` field bypass. This vulnerability allows a low-privileged authenticated user to bypass prototype boundary filtering to extract internal functions and properties from the global prototype object this violates data isolation and lets a user read more than they should. This issue has been patched in version 2.24.0.

Weakness: CWE-20, CWE-200, CWE-125

Which versions are affected by CVE-2026-35038?

2 open source packages ship an affected version, including signalk-server. It affects 1 product.

Products include Signalk Signal K Server.

How do I fix CVE-2026-35038?

Upgrade signalk-server to 2.24.0 or later.

Is CVE-2026-35038 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35038 exists.

Other vulnerabilities in signalk-server

• CVE-2026-23515 RCE - Command Injection in Signal K set-system-time plugin Critical 10.0
• CVE-2025-66398 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE) Critical 9.7
• CVE-2026-33950 signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity Critical 9.4
• CVE-2025-68620 Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling Critical 9.1
• CVE-2026-41893 Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force) High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qh3j-mrg8-f234.