CVE-2026-59809 — SiYuan before v3.8.0 Secret Exfiltration via http_request URL
SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the http_request MCP tool, allowing attackers to exfiltrate stored secrets. An MCP cl…
Published: 2026-08-22 · CVSS: 6.9 · CVSS 4.0
SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the http_request MCP tool, allowing attackers to exfiltrate stored secrets. An MCP client can craft a request with an attacker-controlled URL containing secret placeholders to send plaintext secret values to any public host without confirmation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7