CVE-2026-74799: SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure
SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider API keys.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74799?
CVE-2026-74799 has a severity rating of critical with a CVSS score of 9.3.
How do I fix CVE-2026-74799?
To fix CVE-2026-74799, update SiYuan to version 3.7.4 or later, ensuring that the --mode flag is set to 'prod'.
What type of vulnerability is CVE-2026-74799?
CVE-2026-74799 is an unauthenticated debug endpoint information disclosure vulnerability.
What can attackers access through CVE-2026-74799?
Attackers can access sensitive information such as in-memory secrets, including AccessAuthCode and AI provider API keys.
Which versions of SiYuan are affected by CVE-2026-74799?
SiYuan versions prior to 3.7.4 are affected by CVE-2026-74799.