What happened
CVE-2026-74799 (CVSS 9.3 Critical), published 2026-08-17, describes unauthenticated exposure of Go pprof debugging endpoints in SiYuan whenever the app is not explicitly started in production mode, allowing remote extraction of in-memory secrets including AI provider (e.g., OpenAI/Anthropic) API keys.
Why it matters
Leaked AI provider API keys can be used to run up billing charges on the victim's account, exfiltrate data processed through the same provider account, or pivot into other integrations using the same credentials.
Attack vector
When SiYuan's --mode flag is not set to exactly 'prod', Go's net/http/pprof debug endpoints (including /debug/pprof/heap and goroutine dumps) are registered without authentication; attackers can pull heap dumps to extract in-memory secrets including the AccessAuthCode and configured AI provider API keys.
Affected systems
SiYuan (personal knowledge management app with AI integration) before 3.7.4
Mitigation
Upgrade to SiYuan >= 3.7.4; always run in prod mode in any network-exposed deployment; rotate any AI provider API keys configured in affected instances.