Live › vulnerability › CVE-2026-116166
Go to dashboardSiYuan 3.6.0 through 3.8.6 saves a networkServeTLS setting but never applies it, so the kernel API stays reachable over unencrypted HTTP next to HTTPS. A network-adjacent attacker can sniff the login and session cookie, which lacks the Secure attribute, and take over kernel API sessions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams running SiYuan 3.6.0 before 3.8.7 in a shared or networked setup, where the kernel API port is reachable by other machines. A single-user install bound to localhost on a trusted machine is much less exposed. Teams on 3.8.7 or later are not affected.
No product ranges from the sources yet.
3.8.7.3.8.7 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116166")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.