What’s Vulnerable › Vulnerabilities

CVE-2026-116166: SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-25 · updated 2026-10-29
• Weakness: CWE-319

Description

SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.

Affected products

• siyuan-note siyuan: from 3.6.0 before 3.8.7 — fixed in 3.8.7

How to fix

Upgrade to a fixed version: siyuan-note siyuan 3.8.7. Check the vendor advisory for mitigations.

References

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hpj5-f7cj-vvwr
• https://www.vulncheck.com/advisories/siyuan-3.6.0-before-3.8.7-cleartext-transmission-via-unenforced-networkservetls-setting
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hpj5-f7cj-vvwr

Get alerted when CVE-2026-116166 or the next vulnerability affects your stack