{"id":"CVE-2026-77366","published":"2026-10-12T18:17:23.830","lastModified":"2026-10-16T16:00:33.533","description":"obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) has no vault claim, and the folder access-control list is shared globally. Any valid token can therefore select another configured vault and read, write, or delete its contents through affected tools. Version 1.3.1 fixes the vulnerability by binding tokens and request context to a vault and rejecting mismatched input.vault values before scope checks.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-639","CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://github.com/The-40-Thieves/obsidian-tc/commit/38b4992e87dc2715564236e1a42d005ab05a0194","tags":[]},{"url":"https://github.com/The-40-Thieves/obsidian-tc/pull/72","tags":[]},{"url":"https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1","tags":[]},{"url":"https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-84c9-qqpq-2pq5","tags":[]}],"exploitRefs":[{"url":"https://github.com/The-40-Thieves/obsidian-tc/commit/38b4992e87dc2715564236e1a42d005ab05a0194","tags":[]},{"url":"https://github.com/The-40-Thieves/obsidian-tc/pull/72","tags":[]},{"url":"https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1","tags":[]},{"url":"https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-84c9-qqpq-2pq5","tags":[]}],"hasPoc":true,"ai":{"summary":"The vulnerability allows authenticated users to access any configured vault through tool dispatch functions, bypassing normal access controls by using mismatched vault identifiers in requests. This creates a critical privilege escalation vector where attackers can read, write, or delete data across multiple vaults.","exploitability":"Easy to exploit with valid authentication tokens; attackers need only manipulate the input.vault parameter to target other vaults without requiring additional credentials or complex payloads.","blast_radius":"The vulnerability affects all users with valid tokens who can access the tool dispatch endpoints, potentially exposing multiple vaults' contents to unauthorized access across an entire Obsidian vault ecosystem.","remediation":"Upgrade to version 1.3.1 which fixes the vault binding and input validation issues in the tool dispatch functionality.","detection":"Monitor for requests with mismatched vault identifiers in tool dispatch operations where the caller's token context doesn't match the requested vault, particularly in file read/write/delete operations.","tags":["auth-bypass","access-control","vault"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:46:30.964Z"}}