CVE-2026-116166— SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting

Quick assessment

Affected

siyuan-note siyuan

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SiYuan 3.6.0 至 3.8.7 之前的版本虽然接受并持久化了配置项，但从未真正强制执行该设置，导致内核端口在提供 HTTPS 服务的同时，仍通过明文 HTTP 提供完整的 API 访问。与网络相邻的攻击者可以窃听明文的登录流程和会话 Cookie；由于该 Cookie 缺少 Secure 属性，且响应中未包含 HSTS（HTTP 严格传输安全）头，攻击者可借此劫持内核 API 会话。

CVSS 6.8 · Medium Updated Oct 25, 2026

Possible ATT&CK Techniques 2 AI

T1056 · Input Capture T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting

Source: CVE Program / CVE List V5

Vulnerability Description

SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

敏感数据的明文传输

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
siyuan-note	siyuan	3.6.0 ~ 3.8.7	-

II. Public POCs for CVE-2026-116166

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116166

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-116166 (2)

https://www.cve.org/CVERecord?id=CVE-2026-116166

Same Patch Batch · siyuan-note · 2026-10-25 · 6 CVEs total

CVE-2026-116171	7.5 HIGH	SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix
CVE-2026-116167	6.8 MEDIUM	SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter
CVE-2026-116168	6.2 MEDIUM	SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool
CVE-2026-116169	5.4 MEDIUM	SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks
CVE-2026-116170	4.9 MEDIUM	SiYuan before v3.8.7 SQL Injection via History Search op and query

IV. Related Vulnerabilities

Same product: siyuan

Same vendor: siyuan-note

Same weakness: CWE-319