CVE-2026-66012: SiYuan Auth Bypass Vulnerability

CVE-2026-66012 Overview

CVE-2026-66012 is a missing authorization vulnerability in SiYuan, an open-source personal knowledge management application. Versions before v3.7.2 expose the POST /mcp kernel endpoint behind only a generic model.CheckAuth check. The endpoint lacks admin-role and read-only enforcement. When the Publish server runs in anonymous mode, the Publish reverse proxy attaches an anonymous RoleReader JWT to proxied requests. Remote unauthenticated attackers can then reach /mcp and invoke 31 Model Context Protocol (MCP) tools, including a filesystem tool with full read and write access to the workspace. Exploitation leads to complete administrator takeover of the SiYuan instance.

Critical Impact
Unauthenticated remote attackers can read secrets, plant malicious plugins, and gain code execution as administrator on the next desktop launch.

Affected Products

SiYuan versions prior to v3.7.2
SiYuan Publish server configured with Conf.Publish.Enable=true and Conf.Publish.Auth.Enable=false
SiYuan desktop clients that load plugins from data/plugins/

Discovery Timeline

2026-07-25 - CVE-2026-66012 published to the National Vulnerability Database
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-66012

Vulnerability Analysis

The flaw is a missing authorization check [CWE-862] in the SiYuan kernel. The POST /mcp endpoint hosts an MCP server that exposes 31 tools. Authorization is limited to model.CheckAuth, which verifies presence of an authenticated session but does not enforce administrator role or read-only scope. Any request that carries a valid session, including an anonymous RoleReader token, can invoke every MCP tool.

One exposed tool is a filesystem action set with list, read, write, delete, rename, and copy operations across the entire workspace. An attacker can read conf/conf.json to extract accessAuthCode, api.token, and cookieKey in plaintext. The attacker can also write arbitrary files, including a malicious plugin under data/plugins/.

SiYuan desktop loads plugins in an Electron context with nodeIntegration:true and no contextIsolation. On the next desktop launch, the planted plugin executes with full Node.js privileges, giving the attacker code execution as the workspace administrator.

Root Cause

The kernel handler for /mcp relies on a single coarse-grained authentication check. It does not verify whether the caller holds an administrative role or whether the MCP tool being invoked is safe for read-only principals. Combined with the Publish reverse proxy injecting an anonymous RoleReader JWT into proxied requests, this exposes privileged tools to unauthenticated network callers.

Attack Vector

The attack is network-based, unauthenticated, and requires no user interaction. An attacker sends a POST /mcp request through the anonymous Publish reverse proxy. The proxy attaches an anonymous RoleReader JWT, passing the model.CheckAuth gate. The attacker then invokes the file tool to read conf/conf.json, extract secrets, and write a Node-enabled plugin into data/plugins/. When a legitimate user next launches the SiYuan desktop client, the plugin runs and completes takeover.

Refer to the GitHub Security Advisory GHSA-cvhv-7xhj-xjp8 and the VulnCheck advisory for full technical details.

Detection Methods for CVE-2026-66012

Indicators of Compromise

Unexpected POST /mcp requests reaching the SiYuan kernel from external or anonymous sources.
New or modified files under data/plugins/ that were not installed by the workspace owner.
Access or modification timestamps on conf/conf.json that do not correlate with legitimate administrator activity.
Outbound network connections initiated by the SiYuan desktop process shortly after startup.

Detection Strategies

Inspect reverse proxy and application logs for /mcp requests carrying RoleReader tokens.
Monitor filesystem events on data/plugins/ and the workspace root for writes originating from the kernel process.
Alert on reads of conf/conf.json outside of expected startup and settings-change workflows.

Monitoring Recommendations

Baseline normal MCP tool invocations and flag any use of write, delete, rename, or copy file actions.
Track process launches from data/plugins/ and capture parent-child relationships involving the SiYuan Electron process.
Correlate Publish server configuration changes with subsequent /mcp traffic volume.

How to Mitigate CVE-2026-66012

Immediate Actions Required

Upgrade SiYuan to v3.7.2 or later on all kernel and desktop installations.
Rotate accessAuthCode, api.token, and cookieKey values stored in conf/conf.json after upgrading.
Audit data/plugins/ for any plugin that was not intentionally installed and remove suspicious entries.
Restrict network exposure of the SiYuan kernel and Publish server to trusted networks only.

Patch Information

The fix is delivered in commit c72ca4cd09019e5f64afdee8f8c6ec5ef34858db, included in SiYuan v3.7.2. The patch tightens authorization on the /mcp endpoint so that anonymous RoleReader principals cannot invoke privileged MCP tools. Review the SiYuan security advisory before deploying.

Workarounds

Disable the Publish server by setting Conf.Publish.Enable=false until the patch is applied.
If the Publish server must remain enabled, set Conf.Publish.Auth.Enable=true to require authentication on proxied requests.
Block external access to the /mcp path at the reverse proxy or firewall layer.
Run the SiYuan kernel behind a network policy that limits it to localhost or a trusted management segment.

bash

# Example reverse proxy rule to block anonymous MCP access
location /mcp {
    deny all;
    return 403;
}