Is CVE-2026-66012 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66012 being exploited in the wild.

How severe is CVE-2026-66012?

Critical severity, with a CVSS score of 10, published 25 July 2026.

Is there a fix for CVE-2026-66012?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-66012 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-66012?

Check whether you run SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66012: SiYuan missing authorization in MCP kernel endpoint

CVE-2026-66012 · Severity: critical · CVSS 10 · Published 2026-07-25

SiYuan, a personal knowledge management system, contains a critical security flaw in its kernel's Model Context Protocol (MCP) endpoint. When the 'Publish' feature is enabled in anonymous mode to share notes publicly, the system inadvertently grants unauthenticated remote users administrative-level access to the workspace. An attacker can exploit this to steal sensitive configuration data, modify or delete any file in the user's workspace, and gain full control over the host system by planting malicious plugins.

Technologies: SiYuan. Vendors: SiYuan.

Quick answers

Is CVE-2026-66012 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66012 being exploited in the wild.
How severe is CVE-2026-66012?: Critical severity, with a CVSS score of 10, published 25 July 2026.
Which products and versions are affected?: SiYuan < 3.7.2.
Is there a fix for CVE-2026-66012?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-66012 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-66012?: Check whether you run SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization check (CWE-862) exists in the POST /mcp endpoint of the SiYuan kernel. While the endpoint is gated by a general authentication check, it lacks specific administrative or read-only role enforcement. When the Publish server is enabled in anonymous mode, the reverse proxy unconditionally attaches a 'RoleReader' JWT to requests, granting unauthenticated attackers access to 31 MCP tools. These tools include file primitives (list, read, write, delete) that allow an attacker to exfiltrate 'conf/conf.json' (containing plaintext API tokens and auth codes) or plant malicious JavaScript plugins. On desktop versions, these plugins execute with 'nodeIntegration:true' and no 'contextIsolation', leading to remote code execution (RCE) and full administrator takeover. The issue is fixed in version 3.7.2.

Affected products

siyuan-note SiYuan < 3.7.2

Timeline

2026-07-04: other: Vulnerable version 3.7.1 released
2026-07-13: advisory: GitHub Security Advisory published
2026-07-25: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.