CVE-2026-59809: SiYuan before v3.8.0 Secret Exfiltration via http_request URL
SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the httprequest MCP tool, allowing attackers to exfiltrate stored secrets. An MCP client can craft a request with an attacker-controlled URL containing secret placeholders to send plaintext secret values to any public host without confirmation.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
SiYuan deployments before v3.8.0 that use the http_request MCP tool and have stored secrets available for placeholder interpolation are exposed. The attacker needs access to an MCP client capable of submitting a crafted http_request request.
Does exploitation require user confirmation or interaction?
No. A crafted attacker-controlled destination URL containing secret placeholders can cause plaintext secret values to be sent to a public host without confirmation.
What does an attacker need to do to exploit it?
The attacker must craft an http_request MCP tool request whose URL includes secret placeholders. SiYuan interpolates those placeholders into the destination URL, allowing the resulting request to exfiltrate the secret values.