CVE-2026-116166 SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting

High 7.6 Published 25 Oct 2026 Updated 29 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-116166?

CVE-2026-116166 is a high-severity vulnerability in siyuan-note siyuan, published on 25 Oct 2026.

Official description

SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.

Weakness: CWE-319

Which versions are affected by CVE-2026-116166?

How do I fix CVE-2026-116166?

No fix has been published for CVE-2026-116166 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-116166 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-116166 exists.

Sources

Also known as GHSA-89mj-v839-4h76, GHSA-hpj5-f7cj-vvwr.