If your boat runs Signal K, the open-source server that pulls NMEA 2000, NMEA 0183 and sensor data into one place, now is a good moment to check which version you have. Version 2.34.0 came out on 18 October, and it follows a critical security fix in 2.33.0 last month.
What was wrong
The Signal K team published a critical advisory (GHSA-4w32-qx5g-cpwv) on 21 September. In versions before 2.32.0, the log download link could be opened without logging in, and the zip file it produced included the server’s secret signing key. With that key, an attacker could make themselves an administrator. The fix arrived in 2.33.0. The project’s own advice: if your Signal K server can be reached from the internet, update immediately, or set a Data Logging Directory in the server settings.
Version 2.34.0 goes a step further and stores that secret key outside the main security file. It also brings a long list of fixes and features, including track storage for apps, a ShipModul byte-order setting for NMEA 0183 connections, and a batch of Bluetooth fixes.
What about Victron Venus OS Large?
Many owners run Signal K on a Cerbo GX or other GX device using Venus OS Large, where Signal K comes built in and updates with Venus OS. Victron’s public v3.90 beta notes say the beta moved Signal K to v2.30.0 in beta1 and then to the patched v2.33.0 in beta4. The release notes for the current official version, v3.81, don’t mention Signal K. On the Victron community forum, one user has already asked Victron to move to 2.34.0. We haven’t seen a reply from Victron yet.
What we’d do
- Check your Signal K version on its admin page.
- If you’re on anything older than 2.33.0, update. On Venus OS Large, that means waiting for Victron’s official v3.90 or joining the beta, which brings its own risks.
- Don’t open Signal K to the internet with a router port-forward. If you need remote access, use a VPN or Victron’s VRM.
- Set an admin password, which Victron’s own Venus OS Large guide already tells you to do.
Most boats keep Signal K on a private onboard network, so the real risk is small. But a server that controls which GPS and AIS sources your boat trusts is worth five minutes of care.
Sources
- Signal K Server releases (v2.34.0, 18 Oct 2026; v2.33.0, 21 Sep 2026)
- Signal K security advisory GHSA-4w32-qx5g-cpwv
- Victron Venus OS v3.90-beta7 notes (includes beta1/beta4 Signal K lines)
- Victron Venus OS Large guide
- Victron Venus OS v3.81 notes
- Community request (user post, not Victron)
Header image: Signal K logo
