Vulnerability details

CVE-2026-77366

The-40-Thieves obsidian-tc

obsidian-tc tokens can access arbitrary configured vaults

CVSS 3.1

9.9Critical

Official description

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) has no vault claim, and the folder access-control list is shared globally. Any valid token can therefore select another configured vault and read, write, or delete its contents through affected tools. Version 1.3.1 fixes the vulnerability by binding tokens and request context to a vault and rejecting mismatched input.vault values before scope checks.

CVSS scores

Score	Version	Source	Vector
9.9Critical	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
The-40-Thieves	obsidian-tc	< 1.3.1	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-84c9-qqpq-2pq5 x_refsource_CONFIRM
https://github.com/The-40-Thieves/obsidian-tc/pull/72 x_refsource_MISC
https://github.com/The-40-Thieves/obsidian-tc/commit/38b4992e87dc2715564236e1a42d005ab05a0194 x_refsource_MISC
https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-12
Last updated: 2026-10-13
State: Published
Assigner (CNA): GitHub_M
Kolun priority: 21 · Low

Exploit prediction (EPSS)

0.3%

Probability of exploitation in 30 days

23.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-639
Authorization Bypass Through User-Controlled Key
CWE-863
Incorrect Authorization