CVE-2026-74905 SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass
Authenticated attackers can bypass SSRF protections in SiYuan's SafeMode to access internal services and cloud metadata via IPv6 transition addresses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-74905?
CVE-2026-74905 is a medium-severity server-side request forgery vulnerability in siyuan-note siyuan, published on 18 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does not recognize IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001::/32) that embed private IPv4 destinations. When SafeMode is enabled, an authenticated attacker can bypass the SSRF guard via the network forward proxy, WebSocket proxy, or SSE proxy endpoints by supplying a URL whose hostname resolves to such a transition address, reaching internal services and cloud metadata endpoints (e.g., 169.254.169.254). Because the forward proxy returns the full response body, this is a full-read SSRF that can be used to steal instance credentials, reach internal services, and port-scan internal infrastructure.
Weakness: CWE-918
Which versions are affected by CVE-2026-74905?
How do I fix CVE-2026-74905?
No fix has been published for CVE-2026-74905 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-74905 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-74905 exists.
Sources
Also known as GHSA-qrjw-gxw5-x7q9.