SiYuan MCP Endpoint Missing Authorization Leading to Full Workspace Compromise
First seen Jul 25, 2026 · Updated Jul 25, 2026 · CVSS 10
SiYuan before v3.7.2 exposes 31 MCP tools via the /mcp kernel endpoint with only a superficial auth check that fails to enforce admin or role restrictions. When the Publish server runs in anonymous mode, a remote unauthenticated attacker can reach this endpoint, steal plaintext secrets from the config file, and write a malicious plugin that achieves code execution on the victim's desktop app at next launch. This is a critical, fully remotely exploitable vulnerability enabling complete administrator takeover.
Technical Analysis
The /mcp kernel endpoint relies solely on model.CheckAuth, a general authentication check, without verifying admin-role or read-only privileges, exposing a powerful file tool (list/read/write/delete/rename/copy) across the entire workspace to any authenticated caller. The Publish reverse proxy, when anonymous mode is enabled (Conf.Publish.Auth.Enable=false), attaches an anonymous RoleReader JWT to proxied requests, which is sufficient to satisfy CheckAuth and reach /mcp remotely without credentials. Using the file tool, an attacker reads conf/conf.json to extract accessAuthCode, api.token, and cookieKey in plaintext, then writes an arbitrary file into data/plugins/ to plant a malicious plugin. That plugin executes with nodeIntegration:true and no contextIsolation the next time the Electron-based desktop app launches, giving the attacker full Node.js/OS-level code execution and administrator takeover. The vulnerability crosses the MCP tool-authorization boundary and the Electron process-isolation boundary, turning a missing-authz bug in an agent-facing protocol endpoint into full host compromise.
Affected Systems
SiYuan; protocols: MCP
Detection Signatures
- Unauthenticated or anonymous-JWT requests to POST /mcp
- Requests to /mcp originating via Publish reverse-proxy path with RoleReader anonymous token
- File tool invocations targeting conf/conf.json or other sensitive workspace paths
- Unexpected file writes to data/plugins/ not initiated by an authenticated admin session
- New or modified plugin files appearing in data/plugins/ shortly before application restart
- Outbound requests or log entries indicating extraction of accessAuthCode, api.token, or cookieKey values
Remediation Steps
- 1
Upgrade SiYuan
Update to SiYuan v3.7.2 or later, which fixes the missing authorization check on the /mcp endpoint.
- 2
Disable anonymous Publish mode
Set Conf.Publish.Auth.Enable=true or disable Conf.Publish.Enable entirely until patched, to prevent anonymous RoleReader tokens from reaching /mcp.
- 3
Enforce role-based authorization on MCP endpoint
Ensure /mcp and all MCP tool invocations require admin-role verification, not just general authentication, especially for destructive file operations (write/delete/rename).
- 4
Rotate secrets
Rotate accessAuthCode, api.token, and cookieKey immediately if the instance was exposed, since these were stored in plaintext and may have been exfiltrated.
- 5
Audit plugins directory
Inspect data/plugins/ for unauthorized or unrecognized plugin files and remove any that were not intentionally installed by an administrator.
- 6
Harden Electron configuration
Enable contextIsolation and disable nodeIntegration for the desktop client to limit the blast radius of any future plugin-based code execution.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.