Is CVE-2026-74799 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-74799?

CVE-2026-74799 has a CVSS v3 severity of CRITICAL (9.3).

Back

CVE-2026-74799

Description

SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider API keys.