CVE-2026-74905
Received Received - Intake

SiYuan SSRF Bypass via IPv6 Transition Addresses

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does not recognize IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001::/32) that embed private IPv4 destinations. When SafeMode is enabled, an authenticated attacker can bypass the SSRF guard via the network forward proxy, WebSocket proxy, or SSE proxy endpoints by supplying a URL whose hostname resolves to such a transition address, reaching internal services and cloud metadata endpoints (e.g., 169.254.169.254). Because the forward proxy returns the full response body, this is a full-read SSRF that can be used to steal instance credentials, reach internal services, and port-scan internal infrastructure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-74905
EUVD
EUVD-2026-60586

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74905 is a Server-Side Request Forgery (SSRF) vulnerability in SiYuan versions before 3.7.4. The isPrivateIP function in kernel/util/net.go fails to recognize IPv6 transition addresses (NAT64, 6to4, Teredo) that embed private IPv4 destinations. This allows authenticated attackers to bypass SSRF protections by using URLs resolving to these transition addresses, reaching internal services and cloud metadata endpoints.

Detection Guidance

To detect this SSRF vulnerability, check if SiYuan is running a version before 3.7.4. Inspect network proxy logs for requests to IPv6 transition addresses like NAT64 (64:ff9b::/96), 6to4 (2002::/16), or Teredo (2001::/32). Monitor for unusual outbound connections to cloud metadata endpoints (e.g., 169.254.169.254).

Commands: Check SiYuan version with `siYuan --version` or inspect logs for proxy endpoints handling IPv6 transition addresses. Use `tcpdump` or `Wireshark` to capture outbound traffic to known transition address ranges.

Impact Analysis

An attacker could exploit this to access internal services, steal instance credentials via cloud metadata endpoints (e.g., 169.254.169.254), or perform port scans on internal infrastructure. The vulnerability enables full-read SSRF, meaning attackers can retrieve full response bodies from internal targets.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of instance credentials or internal service data may result in non-compliance with data protection and security standards.

Mitigation Strategies

Immediately upgrade SiYuan to version 3.7.4 or later to patch the SSRF vulnerability. Disable SafeMode if not required, as it is the feature enabling this bypass. Review and restrict access to proxy endpoints (HTTP, WebSocket, SSE) to authenticated users only.

Apply network-level controls to block outbound traffic to IPv6 transition address ranges (NAT64, 6to4, Teredo) unless explicitly allowed. Monitor for suspicious activity in proxy logs and cloud metadata endpoint access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74905. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart