CVE-2026-123492 | BDVDB-2026-401256 Detail

Description#

SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware that allows authenticated attackers to crash the kernel by reading nonexistent MCP resources. Attackers with a valid API token can send a resources/read request in an initialized MCP session, causing a panic that terminates the kernel process and interrupts service.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-11-06Record published in the CVE List.
2. Version 22026-11-09Most recent update recorded in the CVE List.