CVE-2026-68585: Jupyter Notebook metadata leak

Q: Is CVE-2026-68585 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-68585, increasing the risk of exploitation.

Q: How to fix CVE-2026-68585?

Upgrade SiYuan to v3.7.3 or later, which adds the missing publish-access check to /api/block/getBlockInfo. Until patched, avoid exposing SiYuan's publish feature to anonymous readers or minimize the use of publish RoleReader tokens on instances containing sensitive notebooks. Audit which documents are marked as excluded from publishing and confirm none contain metadata (titles/paths) that itself is sensitive. For detection, monitor access logs for repeated or sequential getBlockInfo calls from unauthenticated sessions or a single RoleReader token, which would indicate block-ID enumeration/reconnaissance.

Q: What systems are affected by CVE-2026-68585?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines.

Q: What is the CVSS score for CVE-2026-68585?

CVE-2026-68585 has a CVSS v3.1 base score of 5.8 (MEDIUM). The EPSS exploitation probability is 0.19%.

CISO Take

SiYuan, a self-hosted knowledge management tool, exposes an unauthenticated API endpoint that leaks document metadata — title, notebook, path, root ID, and icon — for notes administrators explicitly excluded from publishing. Any anonymous reader or holder of a publish RoleReader token can query this metadata simply by supplying a block ID, no exploit chain or special access required. The practical risk to most organizations is limited: CVSS 5.8 reflects a confidentiality-only impact with no data modification or availability loss, EPSS sits at 0.00194 (bottom of the exploitation-likelihood range despite the percentile label), there is no public exploit or scanner template, and CISA's SSVC decision is TRACK — the lowest-priority track/monitor tier, not act-now. Teams running publish-facing SiYuan instances should still patch to v3.7.3 or later, since the leaked metadata (document titles, notebook names, folder structure) can aid reconnaissance for social engineering or targeted follow-up attacks even though document content itself isn't exposed. Detection-wise, watch for repeated/sequential getBlockInfo calls against block IDs from unauthenticated or low-privilege sessions as a sign of enumeration.

Sources: NVD GitHub Advisory EPSS ATLAS

What is the risk?

Low-to-medium risk in practice. The vulnerability is a straightforward missing-authorization flaw (CWE-862) on a single metadata-only endpoint — confidentiality impact is capped at 'low' per the CVSS vector (C:L/I:N/A:N), meaning no document content, credentials, or system control is exposed, only structural metadata. Exploitability is trivial (AC:L, PR:N, UI:N) and requires only network reach to a publish-enabled SiYuan instance plus a valid or guessable block ID, but the attack surface is narrow: it only affects instances that use SiYuan's publish/sharing feature with anonymous or RoleReader access enabled. No public PoC, no Nuclei template, not in CISA KEV, and CISA SSVC rates it TRACK (monitor, no immediate action). EPSS of 0.00194 places it among the least likely CVEs to see real-world exploitation in the near term.

How does the attack unfold?

Reconnaissance

Attacker locates a publish-enabled SiYuan instance and identifies or guesses valid block IDs for documents.

AML.T0006

Exploitation

Attacker calls /api/block/getBlockInfo with a block ID as an anonymous or RoleReader user; the endpoint fails to enforce publish-access checks and returns metadata for publish-forbidden documents.

AML.T0049

Impact

Attacker collects document titles, notebook names, paths, and icons across restricted documents, mapping the organization's internal knowledge structure for use in follow-on targeting.

AML.T0036

Reconnaissance

Attacker locates a publish-enabled SiYuan instance and identifies or guesses valid block IDs for documents.

AML.T0006

Exploitation

Attacker calls /api/block/getBlockInfo with a block ID as an anonymous or RoleReader user; the endpoint fails to enforce publish-access checks and returns metadata for publish-forbidden documents.

AML.T0049

Impact

Attacker collects document titles, notebook names, paths, and icons across restricted documents, mapping the organization's internal knowledge structure for use in follow-on targeting.

AML.T0036

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter Notebook	go	< 0.0.0-20260721014951-ffde3b21eca4	`0.0.0-20260721014951-ffde3b21eca4`
13.3K OpenSSF 5.8 3.1K dependents Pushed 4d ago 83% patched ~108d to patch Full package profile →

Do you use Jupyter Notebook? You're affected.

How severe is it?

CVSS 3.1

5.8 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Changed

C Low

I None

A None

What should I do?

1 step

Upgrade SiYuan to v3.7.3 or later, which adds the missing publish-access check to /api/block/getBlockInfo. Until patched, avoid exposing SiYuan's publish feature to anonymous readers or minimize the use of publish RoleReader tokens on instances containing sensitive notebooks. Audit which documents are marked as excluded from publishing and confirm none contain metadata (titles/paths) that itself is sensitive. For detection, monitor access logs for repeated or sequential getBlockInfo calls from unauthenticated sessions or a single RoleReader token, which would indicate block-ID enumeration/reconnaissance.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage API AML.T0036 - Data from Information Repositories AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

GOVERN-1.1 - Legal and regulatory requirements involving AI are understood, managed, and documented

OWASP LLM Top 10

LLM06:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-68585?

SiYuan, a self-hosted knowledge management tool, exposes an unauthenticated API endpoint that leaks document metadata — title, notebook, path, root ID, and icon — for notes administrators explicitly excluded from publishing. Any anonymous reader or holder of a publish RoleReader token can query this metadata simply by supplying a block ID, no exploit chain or special access required. The practical risk to most organizations is limited: CVSS 5.8 reflects a confidentiality-only impact with no data modification or availability loss, EPSS sits at 0.00194 (bottom of the exploitation-likelihood range despite the percentile label), there is no public exploit or scanner template, and CISA's SSVC decision is TRACK — the lowest-priority track/monitor tier, not act-now. Teams running publish-facing SiYuan instances should still patch to v3.7.3 or later, since the leaked metadata (document titles, notebook names, folder structure) can aid reconnaissance for social engineering or targeted follow-up attacks even though document content itself isn't exposed. Detection-wise, watch for repeated/sequential getBlockInfo calls against block IDs from unauthenticated or low-privilege sessions as a sign of enumeration.

Is CVE-2026-68585 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-68585, increasing the risk of exploitation.

How to fix CVE-2026-68585?

Upgrade SiYuan to v3.7.3 or later, which adds the missing publish-access check to /api/block/getBlockInfo. Until patched, avoid exposing SiYuan's publish feature to anonymous readers or minimize the use of publish RoleReader tokens on instances containing sensitive notebooks. Audit which documents are marked as excluded from publishing and confirm none contain metadata (titles/paths) that itself is sensitive. For detection, monitor access logs for repeated or sequential getBlockInfo calls from unauthenticated sessions or a single RoleReader token, which would indicate block-ID enumeration/reconnaissance.

What systems are affected by CVE-2026-68585?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines.

What is the CVSS score for CVE-2026-68585?

CVE-2026-68585 has a CVSS v3.1 base score of 5.8 (MEDIUM). The EPSS exploitation probability is 0.19%.

What is the AI security impact?

Affected AI Architectures

RAG pipelines

MITRE ATLAS Techniques

AML.T0036 Data from Information Repositories

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

NIST AI RMF: GOVERN-1.1

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that returns document root metadata including title for publish-forbidden documents without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a block ID to retrieve the title, notebook, path, root ID, and icon of documents administrators marked as excluded from publishing.

Exploitation Scenario

An attacker locates an internet-facing SiYuan instance with publishing enabled (e.g., via search engine reconnaissance or Shodan-style scanning of common SiYuan ports). Using either no authentication or a low-privilege publish RoleReader token, they enumerate or guess sequential/known block IDs against /api/block/getBlockInfo. For each valid ID, the endpoint returns the title, notebook name, path, root ID, and icon of the underlying document — including documents administrators had explicitly excluded from public visibility. The attacker compiles this metadata to map the organization's internal knowledge structure (e.g., notebook names referencing incident response plans, M&A activity, or credentials vaults), which is then used to craft targeted phishing or social-engineering follow-up rather than direct data theft.

Weaknesses (CWE)

CWE-862 Missing Authorization Primary CWE-862 Missing Authorization CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.