Cleartext Transmission Flaw in SiYuan by SiYuan Note

CVE-2026-116166

What is CVE-2026-116166?

SiYuan versions prior to 3.8.7 retain the networkServeTLS setting while failing to enforce it, resulting in full API access being exposed over unencrypted HTTP. This condition allows network-adjacent attackers to intercept sensitive information, compromising the security of user login flows and session cookies. The absence of the Secure attribute and HSTS in responses increases the risk of session hijacking and unauthorized access to kernel API sessions.

References