CVE-2026-77366
CriticalCVSS 9.9Summary
In obsidian-tc prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JWT has no vault claim, and the folder access-control list is shared globally. Any valid token can therefore select another configured vault and read, write, or delete its contents through affected tools.
Risk Assessment
An attacker with a valid token may access data in other vaults, leading to unauthorized disclosure, modification, or loss of data.
Recommendation
Update obsidian-tc to version 1.3.1 or later, which binds tokens and request context to a vault and rejects mismatched input.vault values.
Other vulnerabilities in obsidian-tc
See all- CVE-2026-77364Medium
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only during enumeration. An authenticated caller can directly read sensitive files such as .obsidian/plugins/*/data.json.
- CVE-2026-77363High
A vulnerability in obsidian-tc, a Model Context Protocol server for Obsidian vaults, before version 1.3.1, does not validate Host or Origin headers or enable DNS-rebinding protection in the Streamable HTTP transport. With loopback configuration using auth.mode set to none, a malicious web page can send requests to the local MCP endpoint and gain unrestricted vault access via the http-local caller. Version 1.3.1 fixes the issue by enabling host, origin, and DNS-rebinding validation.
Original NVD description (English source)
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) has no vault claim, and the folder access-control list is shared globally. Any valid token can therefore select another configured vault and read, write, or delete its contents through affected tools. Version 1.3.1 fixes the vulnerability by binding tokens and request context to a vault and rejecting mismatched input.vault values before scope checks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS