CVE-2026-32110: SSRF in SiYuan Kernel

The SSRF vulnerability in SiYuan Kernel allows an attacker to craft malicious requests through the /api/network/forwardProxy endpoint. This can lead to unauthorized access to internal services and resources that are not directly exposed to the internet. An attacker could potentially read sensitive data stored within the SiYuan application or even interact with other internal systems. The full-read nature of the SSRF means the attacker isn't limited to specific protocols or ports, significantly expanding the potential attack surface. While no immediate data exfiltration is guaranteed, successful exploitation could provide valuable reconnaissance information for further attacks.

1. Reserved2026-03-10
2. Published2026-03-12
3. Modified2026-03-23
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-32110 is to upgrade SiYuan Kernel to version 3.6.0 or later. If upgrading immediately is not feasible, consider implementing temporary workarounds such as restricting outbound network access from the SiYuan server using a firewall or proxy. Carefully review and restrict the allowed domains or IP addresses that the /api/network/forwardProxy endpoint can access. Implementing a Web Application Firewall (WAF) with SSRF protection rules can also help to block malicious requests. Monitor application logs for suspicious outbound requests originating from the /api/network/forwardProxy endpoint.