Quick answers
- Is CVE-2026-116166 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116166 being exploited in the wild.
- How severe is CVE-2026-116166?
- Medium severity, with a CVSS score of 6.8, published 25 October 2026.
- Which products and versions are affected?
- SiYuan 3.6.0 through 3.8.6.
- Is there a fix for CVE-2026-116166?
- Yes: fixed in SiYuan 3.8.7. Until then: Do not enable the networkServeTLS setting until upgrading to version 3.8.7 or later, or restrict kernel port access to trusted networks only using network segmentation or firewall rules. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-116166 attacked?
- It is attacked from the adjacent network, in a hosted service.
- Am I affected by CVE-2026-116166?
- Check whether you run SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: SiYuan 3.8.7
Do not enable the networkServeTLS setting until upgrading to version 3.8.7 or later, or restrict kernel port access to trusted networks only using network segmentation or firewall rules.
Technical details
The vulnerability stems from a configuration option networkServeTLS that is accepted and persisted but never enforced; the kernel's serve.go only uses it to select a log message rather than actually enforce TLS on the listener. The multiplexer in cmux.go feeds both plain HTTP (cmux.Any()) and HTTPS (cmux.TLS()) to the same port simultaneously. Session cookies lack the Secure flag and HTTPS responses omit HSTS, allowing credential theft and session hijacking over the cleartext channel, even when HTTPS is available on the same port.
Affected products
- SiYuan SiYuan 3.6.0 through 3.8.6
Timeline
- 2026-10-09: disclosed
- 2026-10-25: advisory