Skip to content

CVE-2026-66012 — SiYuan /mcp Missing Authorization (Unauthenticated Workspace RCE)

Key facts

CVE-2026-66012 is a Critical (10.0) vulnerability: SiYuan /mcp Missing Authorization (Unauthenticated Workspace RCE). This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab.
CVE CVE-2026-66012
Severity Critical (10.0)
Detection / prevention Snort, YARA, Nginx, Apache
PoC poc.py
Source 2026/CVE-2026-66012/

Details

CVE-2026-66012 is a Critical (10.0) vulnerability: SiYuan /mcp Missing Authorization (Unauthenticated Workspace RCE). This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.
CVSS v3 10.0 (Critical)
CWE CWE-862 Missing Authorization
Affected SiYuan < v3.7.2
Fixed v3.7.2
Vector Network / Unauthenticated

For authorized security testing, CTF, and research only.

Summary

The POST /mcp kernel endpoint is gated only by a general auth check (model.CheckAuth) with no admin-role or read-only enforcement. It exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy across the whole workspace.

When the Publish server runs in anonymous mode (Conf.Publish.Enable=true and Conf.Publish.Auth.Enable=false), the Publish reverse proxy attaches an anonymous RoleReader JWT to proxied requests, so a remote unauthenticated attacker reaches /mcp. From there they can:

  • read conf/conf.json to extract accessAuthCode, api.token, cookieKey in plaintext,
  • write arbitrary files in the workspace,
  • plant a plugin into data/plugins/ that runs with nodeIntegration:true / no contextIsolation on the next desktop launch → administrator takeover.

Root cause

The endpoint authorizes authentication but not authorization: a RoleReader principal (which the anonymous publish proxy issues) is allowed to invoke privileged MCP tools. Fix enforces an admin/non-reader role on /mcp.

Detection (poc.py)

Non-destructive check: sends an unauthenticated POST /mcp tools/list request as an anonymous reader and reports VULNERABLE if privileged file tools are enumerated without admin auth. It does not read or write workspace files.

python poc.py --target http://TARGET:6806

Lab

docker compose up --build      # vulnerable on :6806, patched on :6807
./run-tests.sh                 # or run-tests.ps1 on Windows

Remediation

  • Upgrade to SiYuan v3.7.2+.
  • Never expose the kernel/Publish server anonymously; set Conf.Publish.Auth.Enable=true.
  • Apply the prevention/ rules to block/authenticate /mcp at the edge (see prevention/README.md).

Detection and prevention

Ready-to-deploy defensive rules for CVE-2026-66012, for authorized testing and blue-team detection engineering:

References: NVD — CVE-2026-66012 · full write-up on the searchable site

Detection & prevention rules

# CVE-2026-66012 — SiYuan /mcp missing authorization (Snort/Suricata)
# Detect unauthenticated JSON-RPC access to the kernel /mcp endpoint and calls
# to privileged file tools. Tune $HOME_NET / sid to your environment.

alert http $EXTERNAL_NET any -> $HOME_NET any ( \
    msg:"CVE-2026-66012 SiYuan /mcp tools/list (possible missing-auth enum)"; \
    flow:established,to_server; http.method; content:"POST"; \
    http.uri; content:"/mcp"; startswith; \
    http.request_body; content:"tools/list"; nocase; \
    classtype:web-application-attack; sid:2026066012; rev:1; )

alert http $EXTERNAL_NET any -> $HOME_NET any ( \
    msg:"CVE-2026-66012 SiYuan /mcp privileged file tool invocation"; \
    flow:established,to_server; http.method; content:"POST"; \
    http.uri; content:"/mcp"; startswith; \
    http.request_body; content:"tools/call"; nocase; \
    http.request_body; content:"file"; nocase; \
    classtype:web-application-attack; sid:2026066013; rev:1; )

:material-file-download: prevention/snort.rules

/*
 * CVE-2026-66012 — SiYuan /mcp missing authorization
 * Post-exploitation file artifacts: a planted SiYuan plugin that runs with
 * nodeIntegration enabled and contextIsolation disabled, and workspace-config
 * exfiltration containing plaintext secrets.
 */

rule CVE_2026_66012_malicious_siyuan_plugin
{
    meta:
        cve = "CVE-2026-66012"
        description = "SiYuan plugin planted via /mcp file write, unsafe Electron flags"
        severity = "critical"
    strings:
        $manifest = "plugin.json" ascii
        $ni = "nodeIntegration" ascii nocase
        $ni_true = /nodeIntegration\s*[:=]\s*true/ nocase
        $ci_false = /contextIsolation\s*[:=]\s*false/ nocase
        $req = "require(" ascii
        $child = "child_process" ascii
    condition:
        $manifest and $ni and ($ni_true or $ci_false) and ($req or $child)
}

rule CVE_2026_66012_conf_exfil
{
    meta:
        cve = "CVE-2026-66012"
        description = "SiYuan conf.json secrets read via /mcp file tool"
        severity = "high"
    strings:
        $a = "accessAuthCode" ascii
        $b = "cookieKey" ascii
        $c = "\"token\"" ascii
        $d = "Publish" ascii
    condition:
        3 of them
}

:material-file-download: prevention/yara.yar

# CVE-2026-66012 — SiYuan /mcp missing authorization
# Edge mitigation: block/authenticate the kernel MCP endpoint so the anonymous
# Publish proxy (RoleReader) cannot reach it. Place inside the SiYuan server block.

location = /mcp {
    # 1) Never expose /mcp anonymously via the Publish server. Restrict to the
    #    trusted admin network only.
    allow 10.0.0.0/8;         # <- adjust to your admin subnet
    allow 127.0.0.1;
    deny  all;

    # 2) Require an authenticated admin session at the edge as defense in depth.
    auth_request /_mcp_authz;

    proxy_pass http://127.0.0.1:6806;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
}

# Sub-request that must return 2xx only for privileged/admin sessions.
location = /_mcp_authz {
    internal;
    proxy_pass http://127.0.0.1:6806/api/system/currentUser;  # adjust to your authz check
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
}

:material-file-download: prevention/nginx.conf

# CVE-2026-66012 — SiYuan /mcp missing authorization (Apache + ModSecurity)

# 1) Network restriction on the MCP endpoint.
<LocationMatch "^/mcp$">
    Require ip 127.0.0.1 10.0.0.0/8    # <- adjust to your admin subnet
</LocationMatch>

# 2) ModSecurity: block MCP requests carrying the anonymous reader role, or
#    JSON-RPC calls to privileged file tools over /mcp.
SecRule REQUEST_URI "@streq /mcp" \
    "id:2026066012,phase:2,deny,status:403,log,\
     msg:'CVE-2026-66012 SiYuan /mcp access blocked',chain"
    SecRule REQUEST_HEADERS:X-Siyuan-Role "@rx ^(reader)$|^$" "t:lowercase"

SecRule REQUEST_URI "@streq /mcp" \
    "id:2026066013,phase:2,deny,status:403,log,\
     msg:'CVE-2026-66012 privileged MCP file tool call',chain"
    SecRule REQUEST_BODY "@rx \"(tools/call|file(_read|_write|_delete)?)\"" "t:none"

:material-file-download: prevention/httpd.conf

Frequently asked questions

What is CVE-2026-66012?

CVE-2026-66012 is a Critical (10.0) vulnerability: SiYuan /mcp Missing Authorization (Unauthenticated Workspace RCE). This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-66012?

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-66012?

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

For authorized security testing and research only. See the full source and NVD record.