CVE-2026-66012Patch

MEDIUMCVSS 10.0 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check (model.CheckAuth) with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy actions across the entire workspace. When the Publish server is enabled in anonymous mode (Conf.Publish.Enable=true and Conf.Publish.Auth.Enable=false), the Publish reverse proxy attaches an anonymous RoleReader JWT to proxied requests, allowing a remote unauthenticated attacker to reach /mcp. The attacker can read conf/conf.json to extract accessAuthCode, api.token, and cookieKey in plaintext, write arbitrary files in the workspace, and plant a plugin into data/plugins/ that executes with nodeIntegration:true and no contextIsolation on the next desktop launch, leading to administrator takeover.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-862

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
13 mentions across 5 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 2 signals
PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 7 signals
Technical details provided in 11 signals
Disclosure: 5 classified signals
Peaked 4d ago at 6 mentions (2026-07-25); latest day: 1
13 total mentions across 5 days

Deep dive

Activity timeline13 mentions / 5d

Signal classification4 categories

Patch

646.2%

Disclosure

538.5%

Exploit

17.7%

PoC

17.7%

Referenced assets9 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-25	6	Disclosure3Patch3
2026-07-26	2	Disclosure1Patch1
2026-07-27	2	Exploit1PoC1
2026-07-29	2	Disclosure1Patch1
2026-07-30	1	Patch1

Full discourse13 posts

ROOTCAUSE@rootcausehq91d
Disclosure
SiYuan's /mcp kernel endpoint checks you are authenticated, then stops. No admin role, no read-only enforcement. It exposes 31 MCP tools, including a file tool with write and delete across the entire workspace. CVSS 10.0. Fixed in v3.7.2. https://nvd.nist.gov/vuln/detail/CVE-2026-66012 #mcp #cve https://t.co/LT4AVz2gtQ
Post summary
The post discloses a high‑severity (CVSS 10.0) vulnerability in SiYuan’s /mcp endpoint, detailing the lack of role enforcement and file‑write capabilities, and notes that a patch (v3.7.2) fixes the issue.
0101092
578 followersView on X
SecAlerts@SecAlertsCo88d
Patch
🗒️ SiYuan before v3.7.2: CVE-2026-66012 — POST /mcp kernel endpoint lacks admin-role enforcement, enabling unauthenticated admin takeover. CVSS 10. Upgrade to v3.7.2 immediately. #cybersecurity #vulnerabilities #ciso #cto #mssp https://secalerts.co/vulnerability/CVE-2026-66012?utm_campaign=x https://t.co/QwCFeqOgME
Post summary
The tweet alerts that SiYuan’s pre‑v3.7.2 releases have a CVSS 10 admin‑takeover flaw (CVE‑2026‑66012) and urges users to immediately upgrade to v3.7.2 for remediation.
00010234
872 followersView on X
ExploitGrid@exploitgrid89d
PoC
[EXPLOIT] EGE-GH-9Uazq6b [CRITICAL/PoC] #siyuan-mcp-admin-takeover-cve-2026-66012-missing-authorization 🔗 https://exploitgrid.net/exploits/9ff96fd5-cb14-4cae-871a-cd8e90ca144c
Post summary
A PoC for the missing‑authorization vulnerability in Siyuan MCP (CVE‑2026‑66012) is shared via an exploit grid link, demonstrating exploitability but with no evidence of active exploitation or mitigation steps.
1000042
28 followersView on X
ExploitGrid@exploitgrid89d
Exploit
[EXPLOIT] EGE-GH-9Uazq6b [CRITICAL/PoC] #siyuan-mcp-admin-takeover-cve-2026-66012-missing-authorization 🔗 https://exploitgrid.net/exploits/9ff96fd5-cb14-4cae-871a-cd8e90ca144c
Post summary
The post announces a critical missing‑authorization vulnerability (CVE‑2026‑66012) in Siyuan MCP admin, providing a PoC exploit via ExploitGrid, with no mention of patch or active exploitation.
1000040
28 followersView on X
Orizon@OrizonCyber92d
Patch
🚨 CVE-2026-66012 — CVSS 10/10 ██████████ SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/CNUGE26sIs
Post summary
The tweet alerts to a critical missing‑auth CVE‑2026‑66012 in SiYuan pre‑v3.7.2, with a patch now available. No exploit or PoC details are provided.
1000078
69 followersView on X
SecNews@SecNews_GR92d
Disclosure
CVE-2026-66012: κρίσιμη ευπάθεια στο SiYuan εκθέτει εργαλεία MCP και αρχεία workspace https://secn.ws/QjOJx6
Post summary
The post announces a critical vulnerability (CVE‑2026‑66012) in SiYuan that exposes MCP tools and workspace files, providing technical details but no PoC, exploit, patch information, or evidence of active exploitation.
00010175
7.0K followersView on X
CCB Alert@CCBalert87d
Patch
Warning: Critical missing authorisation vulnerability in #SiYuan CVE-2026-66012 CVSS: 10. This vulnerability allows, for certain configurations, to write files and install plugins. See https://github.com/siyuan-note/siyuan/security/advisories/GHSA-cvhv-7xhj-xjp8 for more info and a safer configuration. #Patch #Patch #Patch
Post summary
The advisory warns of a critical missing authorization flaw in SiYuan (CVE‑2026‑66012) that permits file writes and plugin installation, and directs users to apply the provided patch or safer configuration.
00000324
7.2K followersView on X
Israel@f1tym187d
Disclosure
CVE-2026-66012 describes a critical missing authorization vulnerability in SiYuan note-taking software before version 3. https://ift.tt/Z0fBCKw
Post summary
The post announces a critical missing‑authorization flaw (CVE‑2026‑66012) in SiYuan note‑taking software prior to v3, but it does not provide a proof of concept, patch details, or evidence of active exploitation.
0000042
1.0K followersView on X
ThreatAft@ThreatAft91d
Patch
🚨 SiYuan Admin Takeover — CVSS 10.0 CVE-2026-66012: Unauthenticated attackers can take over the entire system via /mcp endpoint. One request. Full access. No credentials needed. Update to 3.7.2 NOW. → http://threataft.com/articles/siyuan-cve-2026-66012-admin-takeover #cybersecurity #infosec #SiYuan #threatintel
Post summary
The post highlights a critical unauthenticated admin takeover vulnerability (CVE-2026-66012) in SiYuan, urging immediate patch to version 3.7.2.
0000025
34 followersView on X
ADK Cyber@ADKCyber91d
Patch
CVE-2026-66012 (CVSS 10.0) in SiYuan < v3.7.2 allows unauthorized access via the /mcp endpoint. Update to 3.7.2+ if deployed. via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/sy34Wlfiu4
Post summary
The tweet announces CVE‑2026‑66012 for SiYuan before version 3.7.2 with a CVSS 10.0 score, indicates unauthorized access via the /mcp endpoint, and urges users to update to 3.7.2+. No exploitation evidence or PoC is provided.
0000034
90 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds92d
Disclosure
CVE-2026-66012 Missing Authorization in SiYuan MCP Kernel Endpoint Leading to Remote Code Execution https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-66012
Post summary
An identified missing authorization flaw in the SiYuan MCP Kernel Endpoint permits remote code execution, constituting a newly disclosed vulnerability.
00000124
4.1K followersView on X
CVE@CVEnew92d
Disclosure
CVE-2026-66012 SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check (model.CheckAuth) wi… https://www.cve.org/CVERecord?id=CVE-2026-66012
Post summary
The post discloses that SiYuan versions prior to v3.7.2 have a missing authorization flaw in the POST /mcp kernel endpoint, but it offers no PoC, exploit, patch, or evidence of active exploitation.
00000766
57.9K followersView on X
Upwind Security MDR@UpwindMDR92d
Patch
🚨 CRITICAL - Unauthenticated /mcp endpoint enables arbitrary file read/write & plugin planting (CVE-2026-66012) SiYuan before v3.7.2 exposes multiple MCP tools via the kernel POST /mcp endpoint, including a file tool capable of workspace-wide file operations. The issue is missing authorization/improper access control on the /mcp endpoint when the Publish server is enabled in anonymous mode. An unauthenticated attacker can reach /mcp through a reverse proxy that attaches an anonymous RoleReader JWT, then read conf/conf.json to extract secrets and write arbitrary files into the workspace. Impact includes full data compromise and escalation to administrator takeover by planting a malicious plugin that executes on the next desktop launch, effectively achieving code execution under the user/admin context. 👉 Affected: siyuan < 3.7.2 | Upgrade to 3.7.2
Post summary
SiYuan versions below 3.7.2 allow unauthenticated file read/write via the /mcp endpoint, but the issue is mitigated by upgrading to 3.7.2.
00000108
254 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-66012

ROOTCAUSE[verified]@rootcausehqDisclosure

The post discloses a high‑severity (CVSS 10.0) vulnerability in SiYuan’s /mcp endpoint, detailing the lack of role enforcement and file‑write capabilities, and notes that a patch (v3.7.2) fixes the issue.

Orizon[verified]@OrizonCyberPatch

The tweet alerts to a critical missing‑auth CVE‑2026‑66012 in SiYuan pre‑v3.7.2, with a patch now available. No exploit or PoC details are provided.

SecNews[verified]@SecNews_GRDisclosure

The post announces a critical vulnerability (CVE‑2026‑66012) in SiYuan that exposes MCP tools and workspace files, providing technical details but no PoC, exploit, patch information, or evidence of active exploitation.

Israel[verified]@f1tym1Disclosure

The post announces a critical missing‑authorization flaw (CVE‑2026‑66012) in SiYuan note‑taking software prior to v3, but it does not provide a proof of concept, patch details, or evidence of active exploitation.

ADK Cyber[verified]@ADKCyberPatch

The tweet announces CVE‑2026‑66012 for SiYuan before version 3.7.2 with a CVSS 10.0 score, indicates unauthorized access via the /mcp endpoint, and urges users to update to 3.7.2+. No exploitation evidence or PoC is provided.

Upwind Security MDR[verified]@UpwindMDRPatch

SiYuan versions below 3.7.2 allow unauthenticated file read/write via the /mcp endpoint, but the issue is mitigated by upgrading to 3.7.2.

SecAlerts@SecAlertsCoPatch

The tweet alerts that SiYuan’s pre‑v3.7.2 releases have a CVSS 10 admin‑takeover flaw (CVE‑2026‑66012) and urges users to immediately upgrade to v3.7.2 for remediation.

ExploitGrid@exploitgridPoC

A PoC for the missing‑authorization vulnerability in Siyuan MCP (CVE‑2026‑66012) is shared via an exploit grid link, demonstrating exploitability but with no evidence of active exploitation or mitigation steps.