CVE-2026-35038

CVE-2026-35038 is a medium-severity arbitrary prototype read vulnerability affecting Signal K Server versions prior to 2.24.0, a server application used on boats. This flaw allows a low-privileged authenticated user to bypass data isolation and extract internal functions and properties from the global prototype object, leading to unauthorized information disclosure. Rated with a CVSS score of 5.3, it has a network attack vector and low attack complexity, requiring only low privileges for exploitation. There is currently no public exploit code available, nor is it listed in CISA's KEV catalog or actively exploited, though it has garnered minimal community discussion since its recent publication.