CVE-2026-74799
Deferred Deferred - Pending Action

SiYuan Debug Endpoints Information Disclosure Vulnerability

Publication date: 2026-08-17

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider API keys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-26
Generated
2026-09-06
AI Q&A
2026-08-17
EPSS Evaluated
2026-09-05
NVD
CVE-2026-74799
EUVD
EUVD-2026-60082

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-215 The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74799 is a critical vulnerability in SiYuan (versions <= 3.7.3) where debug endpoints from Go's net/http/pprof library are exposed without authentication when the application is not running in exact production mode. Attackers can access endpoints like /debug/pprof/heap to extract in-memory secrets such as API keys and authentication codes.

Detection Guidance
  • Check if SiYuan is running with --mode not set to exactly 'prod' by inspecting process arguments or logs.
  • Use curl to test for exposed debug endpoints: curl http://<target>:<port>/debug/pprof/heap or curl http://<target>:<port>/debug/pprof/goroutine.
  • Scan network traffic for requests to /debug/pprof/ endpoints using tools like Wireshark or tcpdump.
  • Check SiYuan configuration files or startup scripts for --mode values other than 'prod'.
Impact Analysis

This vulnerability allows unauthenticated attackers to extract sensitive data from memory, including AI provider API keys and workspace AccessAuthCode. It can also enable resource-exhaustion attacks via endpoints like /debug/pprof/profile, potentially causing CPU overload or system downtime.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data like API keys and authentication codes. Exposure of such secrets may violate data protection requirements for confidentiality and integrity.

Mitigation Strategies
  • Upgrade SiYuan to version 3.7.4 or later to patch the vulnerability.
  • Ensure SiYuan is explicitly run with --mode prod to disable debug endpoints.
  • Block external access to /debug/pprof/ endpoints using a firewall or reverse proxy.
  • Rotate any exposed secrets such as AccessAuthCode or AI provider API keys after mitigation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74799. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart