CVE-2026-73054: SiYuan WebSocket parser differential allows unauthenticated event stream access

CVE-2026-73054 · Severity: high · CVSS 7.5 · Published 2026-10-23

SiYuan is a personal knowledge management system with a kernel component that broadcasts live updates like document changes and notebook operations. An attacker can exploit a flaw in URI parsing to bypass access authentication on the WebSocket endpoint and receive the live event stream without credentials, gaining visibility into all document titles, notebook names, file paths, and operational metadata.

Technologies: github.com/siyuan-note/siyuan/kernel (Go), SiYuan. Vendors: Go, SiYuan.

Quick answers

Is CVE-2026-73054 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-73054 being exploited in the wild.
How severe is CVE-2026-73054?
High severity, with a CVSS score of 7.5, published 23 October 2026.
Which products and versions are affected?
github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260731131820-67bc300b6ea6, SEMVER:introduced=0,fixed=0.0.0-20260731131820-67bc300b6ea6; SiYuan <UNKNOWN>.
Is there a fix for CVE-2026-73054?
Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260731131820-67bc300b6ea6 or later. Until then: Parse the query string instead of matching raw substrings for the keepalive exemption; require both "id" and "type" query parameters to equal "auth" exactly. Reject requests carrying duplicated query keys on the /ws endpoint to prevent a single URI from presenting multiple identities. Record the exemption as a session flag at connection time rather than re-parsing the request URI.</anigation> <parameter name="fixed_in"><UNKNOWN> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73054 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-73054?
Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260731131820-67bc300b6ea6 or later
    go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260731131820-67bc300b6ea6

Parse the query string instead of matching raw substrings for the keepalive exemption; require both "id" and "type" query parameters to equal "auth" exactly. Reject requests carrying duplicated query keys on the /ws endpoint to prevent a single URI from presenting multiple identities. Record the exemption as a session flag at connection time rather than re-parsing the request URI.</anigation> <parameter name="fixed_in"><UNKNOWN>

Technical details

The vulnerability stems from a parser differential: the authentication exemption for keepalive sessions uses substring matching on the raw request URI, while the subsequent session quarantine uses Go's url.Values.Get() which returns only the first value for repeated query keys. An attacker can craft a URI like /ws?app=siyuan&id=main&type=main&id=auth&type=auth that passes the exemption check (contains both "/ws?app=siyuan" and "&id=auth&type=auth") but resolves to a "main" session identity in the broadcast pool, bypassing the authentication requirement entirely. The session receives no authentication token validation and is not gated from the live event stream.

Affected products

  • SiYuan SiYuan <UNKNOWN>

Identifiers

  • CVE-2026-73054
  • GHSA-c8w8-3pqp-wr83
  • GO-2026-6831

Timeline

  • 2026-10-23: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.