CVE-2026-123492

SiYuan MCP resource reads can stop the note service

SiYuan · SiYuan MCP

First documented disclosure · Review checkpoint

Summary

Missing resource reads can stop the note service.

Severity and exploitation evidence

Medium · 6.9/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The MCP adapter treats a missing resource as a valid cache entry.

Conditions required

A client needs a valid API token and an initialized MCP session.

Potential impact

The kernel process can stop, interrupting access for other users.

Affected versions and configurations

Before 3.8.9.

Fix and mitigation status

3.8.9.

Practical next steps

Apply 3.8.9 and monitor for unexpected kernel restarts.

Operating lesson

Handle missing resources without terminating the service.

Evidence and limits

The maintainer advisory was public October 22. VulnCheck published the CVE on November 6.

Sources