CVE-2026-74905 Overview
CVE-2026-74905 is a server-side request forgery (SSRF) vulnerability [CWE-918] in SiYuan, an open-source note-taking application, affecting versions prior to v3.7.4. The flaw resides in the isPrivateIP function in kernel/util/net.go, which is used by SSRFSafeDialer to enforce SSRF protection when SafeMode is enabled. The function validates loopback, link-local unicast, private, and unspecified addresses but fails to recognize IPv6 transition addresses that embed private IPv4 destinations. Authenticated attackers can bypass the SSRF guard through the network forward proxy, WebSocket proxy, or SSE proxy endpoints to reach internal services and cloud metadata endpoints.
Critical Impact
Full-read SSRF enabling theft of cloud instance credentials from metadata endpoints such as 169.254.169.254, access to internal services, and port scanning of internal infrastructure.
Affected Products
- SiYuan note-taking application versions before v3.7.4
- Deployments with SafeMode enabled relying on SSRFSafeDialer for outbound request filtering
- Instances exposing the network forward proxy, WebSocket proxy, or SSE proxy endpoints
Discovery Timeline
- 2026-08-18 - CVE-2026-74905 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-74905
Vulnerability Analysis
The vulnerability stems from incomplete address validation in the isPrivateIP function within kernel/util/net.go. The function inspects loopback, link-local unicast, private, and unspecified address ranges but does not evaluate IPv6 transition mechanisms that encapsulate IPv4 addresses. An authenticated attacker supplies a URL whose hostname resolves to a transition address embedding a private IPv4 target. The SSRFSafeDialer then permits the connection, treating the destination as a public address.
Because the forward proxy endpoint returns the full HTTP response body, this is a full-read SSRF rather than a blind variant. Attackers can extract sensitive content directly from responses, including cloud instance metadata credentials, internal service data, and port-scan results. The WebSocket and SSE proxy endpoints extend the attack surface to streaming protocols.
Root Cause
The root cause is missing recognition of three IPv6 transition ranges: NAT64 64:ff9b::/96, 6to4 2002::/16, and Teredo 2001::/32. Each of these can embed an IPv4 destination inside an IPv6 address. When a hostname resolves to such an address, the pre-connect check classifies it as public and allows the outbound dial. The IPv4 destination reached at the network layer can be 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16.
Attack Vector
An authenticated attacker submits a request to the network forward proxy, WebSocket proxy, or SSE proxy endpoint with a URL whose hostname resolves via DNS to an IPv6 transition address embedding a private IPv4 target. The dialer bypasses SafeMode SSRF checks and completes the connection to the internal destination. The proxy then returns the full response body to the attacker. Practical targets include the AWS Instance Metadata Service at http://169.254.169.254/latest/meta-data/iam/security-credentials/, internal admin panels, and unauthenticated internal APIs.
Refer to the GitHub Security Advisory GHSA-qq8m-8p8v-x4xg and the VulnCheck SSRF Advisory for Siyuan for further technical detail.
Detection Methods for CVE-2026-74905
Indicators of Compromise
- Outbound requests from the SiYuan kernel process to IPv6 transition ranges 64:ff9b::/96, 2002::/16, or 2001::/32.
- Access log entries for /api/network/forwardProxy, WebSocket proxy, or SSE proxy endpoints containing IPv6-formatted hostnames or NAT64/6to4/Teredo literals.
- Egress connections from SiYuan hosts to cloud metadata IPs including 169.254.169.254 or fd00:ec2::254.
Detection Strategies
- Alert on any proxy endpoint invocation whose resolved destination falls within an IPv6 transition prefix.
- Correlate SiYuan proxy request logs with DNS resolution telemetry to detect hostnames mapping to embedded RFC1918 addresses.
- Baseline normal outbound destinations for the SiYuan service and flag deviations toward link-local or metadata endpoints.
Monitoring Recommendations
- Enable verbose logging on the forward proxy, WebSocket, and SSE proxy handlers to capture requested URLs and resolved IPs.
- Deploy network egress filtering that denies traffic from the SiYuan host to cloud metadata endpoints and internal management subnets.
- Ingest SiYuan application logs and host network telemetry into a SIEM for cross-source correlation.
How to Mitigate CVE-2026-74905
Immediate Actions Required
- Upgrade SiYuan to v3.7.4 or later on all deployments.
- Restrict access to SiYuan proxy endpoints to trusted authenticated users only.
- Apply host-level egress firewall rules blocking traffic from SiYuan servers to 169.254.169.254, IMDSv2 IPv6 endpoints, and internal management ranges.
Patch Information
The SiYuan maintainers addressed CVE-2026-74905 in release v3.7.4 by extending isPrivateIP to recognize NAT64 64:ff9b::/96, 6to4 2002::/16, and Teredo 2001::/32 prefixes and inspect the embedded IPv4 destination against private-range checks. See the GitHub Security Advisory GHSA-qq8m-8p8v-x4xg for release details.
Workarounds
- Disable the network forward proxy, WebSocket proxy, and SSE proxy endpoints if they are not required for operational use.
- Enforce IMDSv2 with hop-limit 1 on AWS instances hosting SiYuan to blunt metadata credential theft.
- Deploy an outbound HTTP proxy that resolves destination hostnames and denies traffic to IPv6 transition prefixes and RFC1918 IPv4 ranges.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
