CVE-2026-74905: SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass
SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does not recognize IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001::/32) that embed private IPv4 destinations. When SafeMode is enabled, an authenticated attacker can bypass the SSRF guard via the network forward proxy, WebSocket proxy, or SSE proxy endpoints by supplying a URL whose hostname resolves to such a transition address, reaching internal services and cloud metadata endpoints (e.g., 169.254.169.254). Because the forward proxy returns the full response body, this is a full-read SSRF that can be used to steal instance credentials, reach internal services, and port-scan internal infrastructure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.7.4 - Compensating control
If you cannot immediately upgrade to SiYuan v3.7.4, restrict network access to the forward proxy / WebSocket proxy / SSE proxy endpoints so authenticated attackers cannot use these proxy paths to reach internal services or cloud metadata endpoints (e.g., 169.254.169.254).
Event History
Frequently Asked Questions
Which deployments are exposed?
Instances running a version before v3.7.4 are affected when SafeMode is enabled and an authenticated user can access the network forward proxy, WebSocket proxy, or SSE proxy endpoints. Internal services and cloud metadata endpoints may be reachable through the bypass.
What does an attacker need to exploit this issue?
An attacker needs authenticated access and must supply a URL with a hostname that resolves to an IPv6 transition address embedding a private IPv4 destination, such as NAT64, 6to4, or Teredo address ranges. No user interaction is required.
What is the remediation?
Upgrade SiYuan to v3.7.4 or later. The provided information does not describe an alternative mitigation for deployments that cannot immediately upgrade.
How can I investigate possible exploitation?
Review use of the network forward proxy, WebSocket proxy, and SSE proxy endpoints for requests resolving to IPv6 transition addresses, particularly where they result in access to private IPv4 space or metadata services such as 169.254.169.254. Successful requests may return full response bodies.