CVE-2026-123492 · Package
NO FIX YET · SEE WHAT TO DO
SiYuan before 3.8.9 has a nil pointer dereference in privateCacheMiddleware. An attacker with a valid API token can send a resources/read request for a nonexistent MCP resource, which panics and terminates the kernel process, interrupting service.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running SiYuan with its MCP server or API reachable by clients holding API tokens. An attacker needs a valid token and an initialized MCP session to trigger the crash. Single-user installs without exposed API access are less exposed.
Not affected if mcp-disabled, no-api-token-access
Who cares mcp, self-hosted, siyuan
3.8.9 are in range.3.8.9 or later.SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware that allows authenticated attackers to crash the kernel by reading nonexistent MCP resources. Attackers with a valid API token can send a resources/read request in an initialized MCP session, causing a panic that terminates the kernel process and interrupts service.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.