CVE-2026-74799 siyuan-note CVE debrief

Who should care

SiYuan users, administrators, and security teams should be aware of this vulnerability and take immediate action to secure their installations. This includes reviewing current deployments, restricting access to debug endpoints, and implementing authentication for these endpoints. Security teams should also monitor for suspicious activity around SiYuan debug endpoints and update SiYuan to version 3.7.4 or later as soon as possible. Additionally, operators and platform administrators should verify their configurations and ensure that the --mode flag is set to prod to mitigate this vulnerability. Vulnerability management and security teams should prioritize patching and compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory and change management processes should be reviewed to prevent similar exposures in the future. Source tracking and monitoring should also be implemented to detect potential exploitation attempts. Rollback and change windows should be planned to ensure smooth remediation. Compensating controls, such as restricting access to debug endpoints and enhancing monitoring, should be considered for exposed systems. The CVE record was published on 2026-08-17T11:16:40.017Z and has not been modified since then. The NVD entry is currently Deferred. The vulnerability affects SiYuan versions before 3.7.4. When the --mode flag is not set to exactly prod, SiYuan registers Go net/http/pprof debug endpoints, including heap and goroutine dumps, without authentication. This allows attackers to access /debug/pprof/heap and related endpoints to extract in-memory secrets, such as AccessAuthCode and AI provider API keys. The vulnerability has a CVSS score of 9.2 and is considered CRITICAL. Affected users should prioritize patching to prevent potential sensitive information disclosure. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product or

Technical summary

CVE-2026-74799 is a critical vulnerability in SiYuan, a note-taking application. When the --mode flag is not set to exactly prod, SiYuan registers Go net/http/pprof debug endpoints, including heap and goroutine dumps, without authentication. This allows attackers to access /debug/pprof/heap and related endpoints to extract in-memory secrets, such as AccessAuthCode and AI provider API keys. The vulnerability has a CVSS score of 9.2 and is considered CRITICAL.

Defensive priority

Critical vulnerability in SiYuan, a note-taking application, allowing unauthenticated access to debug endpoints, potentially leading to sensitive information disclosure.

Recommended defensive actions

• Inventory and verify SiYuan installations to identify potential exposure.
• Restrict access to SiYuan debug endpoints.
• Implement authentication for debug endpoints.
• Monitor for suspicious activity around SiYuan debug endpoints.
• Update SiYuan to version 3.7.4 or later.

Evidence notes

The CVE-2026-74799 vulnerability affects SiYuan versions before 3.7.4. When the --mode flag is not set to exactly prod, SiYuan registers Go net/http/pprof debug endpoints, including heap and goroutine dumps, without authentication. This allows attackers to access /debug/pprof/heap and related endpoints to extract in-memory secrets, such as AccessAuthCode and AI provider API keys.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.