---
id: "CVE-2026-116166"
kind: "vulnerability"
aliases: ["CVE-2026-116166"]
title: "SiYuan: TLS-only setting ignored, kernel API served over plain HTTP"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["network", "package", "self-hosted", "siyuan"]
not_affected_if: ["localhost-only", "patched-version"]
published_at: "2026-10-25T14:16:55+00:00"
first_seen_at: "2026-10-25T14:41:23+00:00"
updated_at: "2026-10-25T14:42:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116166", "first_seen_at": "2026-10-25T14:41:23+00:00"}]
---

# SiYuan: TLS-only setting ignored, kernel API served over plain HTTP

SiYuan 3.6.0 through 3.8.6 saves a networkServeTLS setting but never applies it, so the kernel API stays reachable over unencrypted HTTP next to HTTPS. A network-adjacent attacker can sniff the login and session cookie, which lacks the Secure attribute, and take over kernel API sessions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the SiYuan version in the app's About panel or the installed package, and confirm whether it is below `3.8.7`.
- Check whether the kernel listens on a plain HTTP port reachable from other machines on the network, and whether the networkServeTLS setting is enabled.

## Fix

- Upgrade SiYuan to `3.8.7` or later.
- Until upgraded, do not expose the kernel port on untrusted networks and serve it only over localhost or a TLS-terminating reverse proxy.

## Timeline

- 2026-10-25T14:41:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116166

## From the sources

SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_