CVE-2026-123492

SiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources/read

6.9 Medium

SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware that allows authenticated attackers to crash the kernel by reading nonexistent MCP resources. Attackers with a valid API token can send a resources/read request in an initialized MCP session, causing a panic that terminates the kernel process and interrupts service.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.27%Scored on 2026-11-07. The trend appears after a second daily score.

What each source reports

CVE List Score used 6.9

SiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources/read

Record: CVE-2026-123492
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-06

EUVDEUVD-2026-118292 6.9

Record: EUVD-2026-118292
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-06

GitHub AdvisoriesGHSA-pxf5-vpcp-gg52 6.9

SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware...

Record: GHSA-pxf5-vpcp-gg52
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-06

NVD 6.9

Record: CVE-2026-123492
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-06

OSV 6.9

SiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources/read

Record: CVE-2026-123492
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-476
Updated: 2026-11-07

Affected products

siyuan-note siyuan

History

History
Recorded	Changed	Sources
Nov 7, 2026	aliases, references	OSV
Nov 6, 2026	published	EUVD, NVD
Nov 6, 2026	published	EUVD
Nov 6, 2026	references, severity, title	CVE List
Nov 6, 2026	aliases, products, published, references	EUVD
Nov 6, 2026	first indexed	GitHub Advisories

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-123492 is a medium vulnerability (CVSS 6.9) in Siyuan-note Siyuan, published November 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. No source names a fixed version.