# CVE-2026-116166: SiYuan cleartext transmission via unenforced networkServeTLS setting

Source: https://junglewise.ai/threats/cve-2026-116166-siyuan-3-6-0-before-3-8-7-accepts-and-persists-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-25. Updated: 2026-10-25  
License: CC BY 4.0 with a link back

CVE-2026-116166 · Severity: medium · CVSS 6.8 · Published 2026-10-25

SiYuan is a note-taking and personal knowledge management application that includes a kernel server exposing administrative APIs. In versions 3.6.0 through 3.8.6, an operator who enables the networkServeTLS setting to encrypt network traffic discovers the setting is never enforced; the kernel port continues serving the full API over unencrypted HTTP alongside HTTPS. Network-adjacent attackers can intercept login credentials and session cookies to hijack kernel API sessions and compromise the application.

Technologies: [SiYuan](https://junglewise.ai/threats/technologies/siyuan). Vendors: [SiYuan](https://junglewise.ai/threats/vendors/siyuan).

## Quick answers

**Is CVE-2026-116166 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116166 being exploited in the wild.

**How severe is CVE-2026-116166?** Medium severity, with a CVSS score of 6.8, published 25 October 2026.

**Which products and versions are affected?** SiYuan 3.6.0 through 3.8.6.

**Is there a fix for CVE-2026-116166?** Yes: fixed in SiYuan 3.8.7. Until then: Do not enable the networkServeTLS setting until upgrading to version 3.8.7 or later, or restrict kernel port access to trusted networks only using network segmentation or firewall rules. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116166 attacked?** It is attacked from the adjacent network, in a hosted service.

**Am I affected by CVE-2026-116166?** Check whether you run SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in SiYuan 3.8.7

Do not enable the networkServeTLS setting until upgrading to version 3.8.7 or later, or restrict kernel port access to trusted networks only using network segmentation or firewall rules.

## Technical details

The vulnerability stems from a configuration option networkServeTLS that is accepted and persisted but never enforced; the kernel's serve.go only uses it to select a log message rather than actually enforce TLS on the listener. The multiplexer in cmux.go feeds both plain HTTP (cmux.Any()) and HTTPS (cmux.TLS()) to the same port simultaneously. Session cookies lack the Secure flag and HTTPS responses omit HSTS, allowing credential theft and session hijacking over the cleartext channel, even when HTTPS is available on the same port.

## Affected products

- SiYuan SiYuan 3.6.0 through 3.8.6

## Timeline

- 2026-10-09: disclosed
- 2026-10-25: advisory

## References

- [https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hpj5-f7cj-vvwr](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hpj5-f7cj-vvwr)
- [https://www.vulncheck.com/advisories/siyuan-3.6.0-before-3.8.7-cleartext-transmission-via-unenforced-networkservetls-setting](https://www.vulncheck.com/advisories/siyuan-3.6.0-before-3.8.7-cleartext-transmission-via-unenforced-networkservetls-setting)

## Related threats

- [SiYuan path traversal in web fetch](https://junglewise.ai/threats/cve-2026-126776-siyuan-3-7-0-before-3-8-10-on-windows-contains-a-path-traversal)
- [SiYuan publish filter information disclosure in local storage](https://junglewise.ai/threats/go-2026-6836-siyuan-the-publish-filter-for-local-storage-returns-the-7f022e62)
- [SiYuan path traversal via GLOBALROOT alias bypass](https://junglewise.ai/threats/cve-2026-118680-siyuan-3-8-7-through-3-8-8-fails-to-normalize-windows-globalroot)
- [SiYuan SQL injection in history search](https://junglewise.ai/threats/cve-2026-116170-siyuan-before-v3-8-7-contains-an-sql-injection-vulnerability)
- [SiYuan cross-site scripting in /check-auth redirect](https://junglewise.ai/threats/cve-2026-116167-siyuan-from-2-9-0-before-3-8-7-contains-a-cross-site-scripting)