Vulnerability · Published Oct 25, 2026 · Assigned by VulnCheck
CVE-2026-116166SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting
Medium 6.8
In plain English
A medium-severity security flaw in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)0.1%top 98.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| siyuan-note | siyuan | 3.6.0 – before 3.8.7 |
Weakness: CWE-319 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N