CVE-2026-77364
MediumCVSS 6.5Summary
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only during enumeration. An authenticated caller can directly read sensitive files such as .obsidian/plugins/*/data.json.
Risk Assessment
This can lead to exposure of plugin API keys, Obsidian Sync passwords, and other in-vault data. It constitutes a serious breach of confidentiality of data stored in the Obsidian vault.
Recommendation
Update obsidian-tc to version 1.3.1 or later, which denies control directories by default and enforces strictReadDefault on direct request paths. It is also recommended to review access permissions and rotate potentially exposed API keys.
Other vulnerabilities in obsidian-tc
See all- CVE-2026-77363High
A vulnerability in obsidian-tc, a Model Context Protocol server for Obsidian vaults, before version 1.3.1, does not validate Host or Origin headers or enable DNS-rebinding protection in the Streamable HTTP transport. With loopback configuration using auth.mode set to none, a malicious web page can send requests to the local MCP endpoint and gain unrestricted vault access via the http-local caller. Version 1.3.1 fixes the issue by enabling host, origin, and DNS-rebinding validation.
- CVE-2026-77366Critical
In obsidian-tc prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JWT has no vault claim, and the folder access-control list is shared globally. Any valid token can therefore select another configured vault and read, write, or delete its contents through affected tools.
Original NVD description (English source)
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only during enumeration. An authenticated caller can directly read sensitive files such as .obsidian/plugins/*/data.json, potentially exposing plugin API keys, Obsidian Sync passwords, and other in-vault data. Version 1.3.1 fixes the vulnerability by denying the control directories by default and enforcing strictReadDefault on direct request paths.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS