PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-74905 siyuan-note CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-18T12:19:30.780Z and has not been modified since then. The NVD entry is currently Deferred. The SiYuan application before v3.7.4 contains a server-side request forgery (SSRF) vulnerability. The isPrivateIP function in kernel/util/net.go does not properly recognize IPv6 transition addresses (NAT64, 6to4, Teredo), which embed private IPv4 destinations. An authenticated attacker can bypass SSRF protection in SafeMode by supplying URLs resolving to these transition addresses via network forward proxy, WebSocket proxy, or SSE proxy endpoints. This allows full-read SSRF attacks to steal instance credentials, reach internal services, and port-scan internal infrastructure. SiYuan users and administrators, cloud security teams, and network administrators should be aware of this vulnerability. Those using SiYuan versions prior to v3.7.4 are at risk and should take immediate action to mitigate the vulnerability. Authenticated attackers could bypass SSRF protection to reach internal services and cloud metadata endpoints, potentially stealing instance credentials and port-scanning internal infrastructure. The CVE-2026-74905 record indicates a server-side request forgery (SSRF) vulnerability in SiYuan before v3.7.4. The vulnerability exists in the isPrivateIP function in kernel/util/net.go used by SSRFSafeDialer. This function does not recognize IPv6 transition addresses, allowing an authenticated attacker to bypass SSRF protection via certain endpoints. The record was sourced from official databases and references.

Vendor
siyuan-note
Product
siyuan
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-18
Original CVE updated
2026-08-26
Advisory published
2026-08-18
Advisory updated
2026-08-26

Who should care

SiYuan users and administrators, cloud security teams, and network administrators should be aware of this vulnerability. Those using SiYuan versions prior to v3.7.4 are at risk and should take immediate action to mitigate the vulnerability.

Technical summary

The SiYuan application before v3.7.4 contains a server-side request forgery (SSRF) vulnerability. The isPrivateIP function in kernel/util/net.go does not properly recognize IPv6 transition addresses (NAT64, 6to4, Teredo), which embed private IPv4 destinations. An authenticated attacker can bypass SSRF protection in SafeMode by supplying URLs resolving to these transition addresses via network forward proxy, WebSocket proxy, or SSE proxy endpoints. This allows full-read SSRF attacks to steal instance credentials, reach internal services, and port-scan internal infrastructure.

Defensive priority

Authenticated attackers could bypass SSRF protection to reach internal services and cloud metadata endpoints, potentially stealing instance credentials and port-scanning internal infrastructure.

Recommended defensive actions

  • Inventory and verify SiYuan installations for version v3.7.4 or later.
  • Restrict access to network forward proxy, WebSocket proxy, and SSE proxy endpoints.
  • Implement compensating controls to monitor and limit interactions with internal services and cloud metadata endpoints.
  • Review and update the isPrivateIP function to include checks for IPv6 transition addresses.
  • Enforce strict SSRF protection policies in SafeMode.

Evidence notes

The CVE-2026-74905 record indicates a server-side request forgery (SSRF) vulnerability in SiYuan before v3.7.4. The vulnerability exists in the isPrivateIP function in kernel/util/net.go used by SSRFSafeDialer. This function does not recognize IPv6 transition addresses, allowing an authenticated attacker to bypass SSRF protection via certain endpoints. The record was sourced from official databases and references.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-74905 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-74905

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-74905 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-74905

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.