SiYuan CVE-2026-59809

Exploitation requires that the attacker holds MCP client-level access to the target SiYuan instance (CVSS PR:H) - this is not available to arbitrary remote unauthenticated users. The MCP server and specifically the http_request tool must be enabled and reachable, which is a non-default configuration requiring explicit setup. The attacker must also know or be able to discover the secret placeholder syntax used by SiYuan to reference stored credentials. What limits exploitation: authentication as an MCP client (PR:H), non-default MCP deployment, and knowledge of placeholder syntax. What does not limit exploitation once access is obtained: no user interaction is required (UI:N), attack complexity is low (AC:L), and any publicly reachable attacker-controlled host can receive the exfiltrated secrets.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N reflects a meaningful but access-gated risk. The PR:H rating is the dominant limiting factor - exploitation is constrained to parties that already hold MCP client-level access to the SiYuan instance, which is not granted to arbitrary remote users and requires either legitimate access or prior compromise of an MCP client session. The AV:N component indicates the attack can be initiated remotely once that access is established. VC:H confirms complete confidentiality compromise for stored secrets, which could cascade into broader account takeovers if exfiltrated secrets include API keys or authentication tokens. There is no CISA KEV listing and no EPSS data was provided in the input; exploitation probability must be inferred from description only. The impact is high in consequence but the PR:H prerequisite meaningfully constrains the realistic attacker population to insiders, compromised AI agents, or malicious MCP plugins.

An attacker with MCP client access crafts an http_request tool call in which the destination URL contains SiYuan secret placeholder syntax referencing stored API keys or tokens (for example, embedding a placeholder like {{secret.API_KEY}} in the URL path or query string). SiYuan resolves the placeholders before dispatching the request, transmitting the plaintext secret values to the attacker's controlled server. The attacker retrieves the secrets from their server's access logs without any user prompt or confirmation dialog being triggered on the SiYuan side.