CVE-2026-116166 in SiYuan
Summary
by MITRE • 10/25/2026
SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability in SiYuan versions prior to 3.8.7 represents a critical misconfiguration of transport layer security controls within the application's core architecture. Although the software includes a configuration parameter named networkServeTLS intended to enforce encrypted communications, this setting is accepted and persisted by the system but fails to be enforced during runtime operations. This discrepancy creates a state where the kernel port continues to serve full API access over plain HTTP alongside HTTPS connections. The presence of an unencrypted endpoint for administrative or core functionality effectively negates the security benefits provided by TLS encryption, as attackers can bypass encrypted channels entirely and interact with the application using standard, cleartext protocols.
From a technical perspective, this flaw allows network-adjacent adversaries to intercept sensitive data transmitted between clients and the SiYuan server. Because the HTTP endpoint remains active and accessible, login credentials are transmitted in plaintext, making them susceptible to passive sniffing attacks on untrusted networks such as public Wi-Fi or compromised internal segments. Furthermore, the session cookies issued during authentication lack the Secure attribute, which permits these tokens to be sent over insecure connections even if HTTPS is available for other parts of the application. This combination ensures that once an attacker captures a valid session cookie via HTTP sniffing, they can immediately reuse it to hijack the user's active kernel API sessions without needing further credentials or multi-factor authentication bypasses.
The operational impact of this vulnerability is severe, as it directly compromises the confidentiality and integrity of administrative operations within SiYuan. An attacker who successfully exploits this flaw gains full control over the application instance through session hijacking. This level of access allows for unauthorized data exfiltration, modification of documents, potential lateral movement if integrated with other services, and complete disruption of service availability. The absence of HTTP Strict Transport Security (HSTS) headers in server responses further exacerbates the risk by failing to instruct browsers or clients to prefer HTTPS connections exclusively, thereby leaving users vulnerable to protocol downgrade attacks where an attacker might force a connection from HTTPS down to HTTP before credentials are submitted.
This vulnerability aligns with CWE-319, which describes cleartext transmission of sensitive information over a network that is not protected by adequate cryptographic mechanisms. Additionally, the exploitation technique falls under MITRE ATT&CK tactic T1078, specifically valid accounts and session hijacking methods such as credential replay or cookie theft via man-in-the-middle attacks. The failure to enforce TLS despite configuration settings also reflects CWE-326, indicating an insecure transport mechanism due to insufficient encryption strength or implementation errors.
To mitigate this risk, administrators must upgrade SiYuan to version 3.8.7 or later where the networkServeTLS setting is properly enforced by the kernel port logic. Until upgrading is possible, it is recommended to place a reverse proxy in front of the application that strictly enforces HTTPS and redirects all HTTP traffic to encrypted connections. Additionally, configuring HSTS headers on the web server can help prevent protocol downgrade attacks for clients that support them. Ensuring that session cookies are issued with both Secure and HttpOnly attributes will further reduce the risk of cookie theft via client-side scripts or insecure channels. Regular auditing of configuration files is essential to ensure that security settings intended by developers are actually active in production environments, preventing similar discrepancies between declared intent and actual behavior.