CVE-2026-116166
Deferred Deferred - Pending Action

SiYuan Kernel API Session Hijack via Plain HTTP

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116166
EUVD
EUVD-2026-109427

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan-note siyuan 3.6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan 3.6.0 before 3.8.7 has a flaw where it accepts and saves the networkServeTLS setting but does not enforce it. This means the application continues to serve the kernel API over plain HTTP alongside HTTPS. Attackers on the same network can intercept unencrypted login credentials and session cookies, which lack the Secure attribute, and exploit this to hijack kernel API sessions.

Detection Guidance

Check if SiYuan is running on HTTP alongside HTTPS by inspecting network traffic or server logs for plaintext API access. Use packet sniffing tools like tcpdump or Wireshark to monitor unencrypted traffic on the kernel port.

Impact Analysis

If you use SiYuan versions 3.6.0 to 3.8.6, an attacker on your local network could capture your login details and session cookies in plaintext. This could allow them to take control of your SiYuan kernel API sessions, potentially accessing or modifying your notes and data without authorization.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Exposure of session cookies and login credentials in plaintext may result in non-compliance with data protection and security standards, potentially leading to legal and regulatory penalties.

Mitigation Strategies

Upgrade SiYuan to version 3.8.7 or later to enforce the networkServeTLS setting. Disable plain HTTP access if possible and ensure HSTS headers are properly configured.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116166. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart