CVE-2026-116166: SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting

Q: Who is realistically exposed to session hijacking?

Deployments running affected SiYuan versions where an attacker can observe traffic to the kernel port are exposed. The attacker can capture cleartext login traffic and the session cookie from HTTP connections.

Q: Does enabling networkServeTLS prevent HTTP access?

No. Affected versions accept and persist the networkServeTLS setting but do not enforce it, leaving the kernel port available over plain HTTP alongside HTTPS.

Q: What can an attacker do after capturing the session cookie?

The captured cookie can be used to hijack a kernel API session. The exposed API access can affect confidentiality and integrity.

Q: How can I determine whether my instance is affected?

Check whether the SiYuan kernel port still serves the API over HTTP after networkServeTLS has been enabled. The affected range is SiYuan 3.6.0 before 3.8.7.

Published Oct 25, 2026

Updated

SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.

Affected Software

1 affected component

SiYuan SiYuan>=3.6.0<3.8.7

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to session hijacking?

Deployments running affected SiYuan versions where an attacker can observe traffic to the kernel port are exposed. The attacker can capture cleartext login traffic and the session cookie from HTTP connections.

Does enabling networkServeTLS prevent HTTP access?

No. Affected versions accept and persist the networkServeTLS setting but do not enforce it, leaving the kernel port available over plain HTTP alongside HTTPS.

What can an attacker do after capturing the session cookie?

The captured cookie can be used to hijack a kernel API session. The exposed API access can affect confidentiality and integrity.

How can I determine whether my instance is affected?

Check whether the SiYuan kernel port still serves the API over HTTP after networkServeTLS has been enabled. The affected range is SiYuan 3.6.0 before 3.8.7.

CVE-2026-116166: SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting

Affected Software

Event History

Frequently Asked Questions

Who is realistically exposed to session hijacking?

Does enabling networkServeTLS prevent HTTP access?

What can an attacker do after capturing the session cookie?

How can I determine whether my instance is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to session hijacking?

Does enabling networkServeTLS prevent HTTP access?

What can an attacker do after capturing the session cookie?

How can I determine whether my instance is affected?