Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-74799 is a critical-severity Insertion of Sensitive Information Into Debugging Code (CWE-215) vulnerability. Its CVSS base score is 9.2 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to CM-7 (Least Functionality) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-60082
Vulnerability Data
SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider…
more
API keys.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V13.4.2
Mitigating Controls (NIST 800-53 r5) AI
Least functionality directly prohibits enabling unnecessary debug features that would expose the inserted sensitive data.
Developer testing and evaluation will discover debug code containing sensitive information before release.
Requiring documented secure development processes and standards stops insertion of sensitive data into debug paths.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent developers from embedding sensitive information inside debugging statements or code paths.
Explicitly calls for removing confidential data from processes, logs, and memory dumps that debug code commonly exposes.
Hardened configuration baselines and deployment checks can ensure debug features and associated data are disabled in production.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches debug statements and sensitive data leaks.
Separation of environments reduces accidental exposure of debug builds to production.
Secure SDLC mandates removal of debug code and sensitive data before release.
Secure coding standards explicitly prohibit embedding secrets or debug statements.