CVE-2026-74799— SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure
Possible ATT&CK Techniques 2AI
T1005 · Data from Local System T1213 · Data from Information RepositoriesAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| siyuan-note | siyuan | < 3.7.4 | affected |
3.7.4 | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-74799
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider API keys.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
通过Debug信息导致的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| siyuan-note | siyuan | 0 ~ 3.7.4 | - |
II. Public POCs for CVE-2026-74799
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-74799
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-74799 (2)
- 🔗 Go net/http/pprof debug endpoints, including heap dumps, are registered fully unauthenticated whenever --mode is not exactly "prod", exposing in-memory secrets (AI provider API keys, AccessAuthCode) with no corresponding warning on the flag ``` · Advisory · siyuan-note/siyuan · GitHub Read full article vendor-advisory
Same Patch Batch · siyuan-note · 2026-08-17 · 7 CVEs total
| CVE-2026-74800 | 9.0 CRITICAL | SiYuan before v3.7.4 Stored XSS via assets endpoint |
| CVE-2026-74798 | 8.7 HIGH | SiYuan kernel Path Traversal via database_clean MCP tool |
| CVE-2026-74801 | 8.2 HIGH | SiYuan before 3.7.4 Local Privilege Escalation via elevator.exe |
| CVE-2026-74802 | 8.2 HIGH | SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy |
| CVE-2026-74868 | 7.5 HIGH | SiYuan before 3.7.4 Brute-Force Authentication via Publish Service |
| CVE-2026-74867 | 4.2 MEDIUM | SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth |
IV. Related Vulnerabilities
Same product: siyuan
- CVE-2026-74868
SiYuan before 3.7.4 Brute-Force Authentication via Publish S - CVE-2026-74867
SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth - CVE-2026-74802
SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network prox - CVE-2026-74801
SiYuan before 3.7.4 Local Privilege Escalation via elevator. - CVE-2026-74800
SiYuan before v3.7.4 Stored XSS via assets endpoint
Same vendor: siyuan-note
- CVE-2026-74868
SiYuan before 3.7.4 Brute-Force Authentication via Publish S - CVE-2026-74867
SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth - CVE-2026-74802
SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network prox - CVE-2026-74801
SiYuan before 3.7.4 Local Privilege Escalation via elevator. - CVE-2026-74800
SiYuan before v3.7.4 Stored XSS via assets endpoint
Same weakness: CWE-215
- CVE-2026-44934
Exposed tokens in SUSE Rancher AI Agent logs - CVE-2026-33247
NATS credentials are exposed in monitoring port via command- - CVE-2025-12616
PHPGurukul News Portal settings.py insertion of sensitive in - CVE-2025-58598
WordPress Klarna Order Management for WooCommerce Plugin <= - CVE-2025-34081
CONPROSYS HMI System (CHS) < 3.7.7 Exposed PHP Debug Info
V. Comments for CVE-2026-74799
No comments yet