CVE-2026-74868: siyuan unthrottled brute-force

CISO Take

SiYuan's Publish Service, a separate listener on port 6808 enabled by default and unauthenticated at the network layer, protects named publish-viewer accounts with Basic Auth that has no rate limiting, lockout, or backoff, so a remote attacker can hammer the login with unlimited password guesses. This rates CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H) because it requires no privileges or user interaction and is trivial to automate — the only friction is that the operator has to have enabled publishing and named at least one account. There's no evidence of active exploitation: it's not in CISA KEV, no EPSS score is available, and there's no public exploit code or Nuclei template yet, so treat this as a patch-now-not-panic issue rather than a breaking alert. Any org running SiYuan as a shared knowledge base — including one feeding notes into downstream AI/RAG workflows — should upgrade to 3.7.4+ immediately, and until patched should firewall port 6808 to trusted networks only, disable the Publish Service if unused, and rotate publish-account passwords. Watch access/auth logs on the publish listener for repeated failed Basic Auth attempts as a compromise indicator.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

Network-exploitable with low complexity, no privileges, and no user interaction (CVSS 3.1: 7.5, C:H/I:N/A:N) — an attacker who finds an exposed instance can brute-force a named account's password with no throttling whatsoever. The blast radius is confidentiality-only (read access to published notes), not code execution or system takeover, which caps the practical severity below critical. No KEV listing, no EPSS score, and no known public exploit or scanner template lower the near-term likelihood of mass exploitation, but the trivial exploitability (a basic credential-stuffing script) means opportunistic scanning is realistic once the advisory is more widely indexed. Overall: high-severity-by-CVSS, moderate real-world urgency pending patch adoption.

How does the attack unfold?

Discovery

Attacker scans for hosts exposing the unauthenticated-by-default SiYuan Publish Service on TCP port 6808.

AML.T0006

Credential Brute-Force

Attacker submits unlimited Basic Auth password guesses against a named publish-viewer account with no rate limiting or lockout.

AML.T0012

Unauthorized Access

A successful guess authenticates the attacker as the named account, granting access to the Publish Service.

Data Exposure

Attacker reads published notes and notebooks, potentially exfiltrating proprietary knowledge-base content.

Discovery

Attacker scans for hosts exposing the unauthenticated-by-default SiYuan Publish Service on TCP port 6808.

AML.T0006

Credential Brute-Force

Attacker submits unlimited Basic Auth password guesses against a named publish-viewer account with no rate limiting or lockout.

AML.T0012

Unauthorized Access

A successful guess authenticates the attacker as the named account, granting access to the Publish Service.

Data Exposure

Attacker reads published notes and notebooks, potentially exfiltrating proprietary knowledge-base content.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
siyuan	—	—	No patch

Do you use siyuan? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

Upgrade SiYuan to version 3.7.4 or later, which is expected to add throttling/lockout to the Publish Service Basic Auth path. Until patched, restrict TCP port 6808 to trusted networks or a VPN via firewall rules — do not expose the Publish Service directly to the internet. If publishing isn't actively used, disable Conf.Publish entirely. Rotate passwords for all named publish-viewer accounts and choose long, high-entropy passwords to raise the brute-force cost even without server-side throttling. Add an external rate-limiter (e.g., fail2ban or a reverse-proxy rule) in front of port 6808 as a compensating control, and monitor authentication logs for bursts of failed Basic Auth attempts against publish accounts as a detection signal.

How is it classified?

Auth Bypass Data Leakage RAG AML.T0006 - Active Scanning AML.T0012 - Valid Accounts

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

Annex A.6 - AI system security controls

Frequently Asked Questions

What is CVE-2026-74868?

SiYuan's Publish Service, a separate listener on port 6808 enabled by default and unauthenticated at the network layer, protects named publish-viewer accounts with Basic Auth that has no rate limiting, lockout, or backoff, so a remote attacker can hammer the login with unlimited password guesses. This rates CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H) because it requires no privileges or user interaction and is trivial to automate — the only friction is that the operator has to have enabled publishing and named at least one account. There's no evidence of active exploitation: it's not in CISA KEV, no EPSS score is available, and there's no public exploit code or Nuclei template yet, so treat this as a patch-now-not-panic issue rather than a breaking alert. Any org running SiYuan as a shared knowledge base — including one feeding notes into downstream AI/RAG workflows — should upgrade to 3.7.4+ immediately, and until patched should firewall port 6808 to trusted networks only, disable the Publish Service if unused, and rotate publish-account passwords. Watch access/auth logs on the publish listener for repeated failed Basic Auth attempts as a compromise indicator.

Is CVE-2026-74868 actively exploited?

No confirmed active exploitation of CVE-2026-74868 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-74868?

Upgrade SiYuan to version 3.7.4 or later, which is expected to add throttling/lockout to the Publish Service Basic Auth path. Until patched, restrict TCP port 6808 to trusted networks or a VPN via firewall rules — do not expose the Publish Service directly to the internet. If publishing isn't actively used, disable `Conf.Publish` entirely. Rotate passwords for all named publish-viewer accounts and choose long, high-entropy passwords to raise the brute-force cost even without server-side throttling. Add an external rate-limiter (e.g., fail2ban or a reverse-proxy rule) in front of port 6808 as a compensating control, and monitor authentication logs for bursts of failed Basic Auth attempts against publish accounts as a detection signal.

What systems are affected by CVE-2026-74868?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines.

What is the CVSS score for CVE-2026-74868?

CVE-2026-74868 has a CVSS v3.1 base score of 7.5 (HIGH).

What is the AI security impact?

Affected AI Architectures

RAG pipelines

MITRE ATLAS Techniques

AML.T0006 Active Scanning

AML.T0012 Valid Accounts

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6

What are the technical details?

Original Advisory

SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation (PublishServiceTransport.RoundTrip() in kernel/server/proxy/publish.go). The Publish Service runs on a separate, unauthenticated-by-default listener (default TCP port 6808) and gates named publish-viewer accounts (Conf.Publish.Auth.Accounts) with Basic Auth that has no rate limiting, per-account lockout, or backoff. Unauthenticated remote attackers can submit unlimited password guesses against named accounts to gain access to published notes/notebooks.

Exploitation Scenario

An attacker scans the internet for hosts with TCP port 6808 open and fingerprints the SiYuan Publish Service. They identify or guess a named publish-viewer account (often reused or descriptive, e.g., 'team' or 'research') and run an automated Basic Auth brute-force script against `PublishServiceTransport.RoundTrip()` — since there's no rate limiting, lockout, or backoff, the attacker can attempt thousands of password guesses per minute without being blocked. Once a password is found, the attacker authenticates as that account and browses the published notebooks, exfiltrating any notes, documentation, or knowledge-base content shared through the service — potentially including material later reused in internal AI tooling or RAG context stores.

Weaknesses (CWE)

CWE-307 Improper Restriction of Excessive Authentication Attempts

CWE-307 — Improper Restriction of Excessive Authentication Attempts: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

[Architecture and Design] Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]

Source: MITRE CWE corpus.