Cyber Resilience

CVE-2026-74799

Info Disclosure

Public PoCInfo Disclosure
Published
17 August 2026
Modified
17 August 2026
CVSS Score v4 9.2
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0039 32th percentile
Risk Priority 45 floored blend · peak EPSS

Summary

CVE-2026-74799 is a critical-severity Insertion of Sensitive Information Into Debugging Code (CWE-215) vulnerability. Its CVSS base score is 9.2 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to CM-7 (Least Functionality) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider…

more

API keys.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-0895Shared CWE-215
CVE-2025-58598Shared CWE-215
CVE-2025-34081Shared CWE-215
CVE-2025-27684Shared CWE-215
CVE-2023-49194Shared CWE-215
CVE-2023-21462Shared CWE-215
CVE-2026-44934Shared CWE-215
CVE-2026-33247Shared CWE-215
CVE-2024-22194Shared CWE-215
CVE-2024-7569Shared CWE-215

Affected Assets

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V13.4.2

Mitigating Controls (NIST 800-53 r5) AI

Least functionality directly prohibits enabling unnecessary debug features that would expose the inserted sensitive data.

Developer testing and evaluation will discover debug code containing sensitive information before release.

Requiring documented secure development processes and standards stops insertion of sensitive data into debug paths.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent developers from embedding sensitive information inside debugging statements or code paths.

PR.DS-10 partial match
prevents

Explicitly calls for removing confidential data from processes, logs, and memory dumps that debug code commonly exposes.

PR.PS-01 partial match
prevents

Hardened configuration baselines and deployment checks can ensure debug features and associated data are disabled in production.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing in development catches debug statements and sensitive data leaks.

prevents

Separation of environments reduces accidental exposure of debug builds to production.

prevents

Secure SDLC mandates removal of debug code and sensitive data before release.

prevents

Secure coding standards explicitly prohibit embedding secrets or debug statements.

References