Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-77364 · GHSA-cvp8-vvgf-69q4

obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default

Risk score
47/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.2%
Published
12 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only during enumeration. An aut…
Affected
obsidian-tc (npm) < 1.3.1
Fix
Upgrade obsidian-tc to 1.3.1 or later.
Exploitation
No known exploitation

Story map

Story map: obsidian-tcTHE FLAWSTHE FIXCVE-2026-77364Default folder ACL is fail-open;.obsidian plugin secrets arereadable by defaultCVSS 6.5 · EPSS 0%CVE-2026-77366Obsidian-tc tokens can accessarbitrary configured vaultsCVSS 9.9 · EPSS 0%CVE-2026-77363Obsidian-tc HTTP transportlacks Origin/DNS-rebindingprotection, enabling drive-by…CVSS 8.8 · EPSS 0%CVE-2026-115477Declined human-in-the-loopconfirmations can permitdestructive calls over HTTPCVSS 7.1 · EPSS 0%Upgrade obsidian-tc1.3.1 · 1.31.4or later on your release lineWho is exposedobsidian-tc (npm) < 1.3.1AMBER · PATCH THIS WEEKobsidian-tcobsidian-tc is a governed,agent-ready Model ContextProtocol server for Obsidianvaults. Prior to 1.3.1, tooldispatch does not compare thecaller-controlled input.vaultvalue with the vault bound to…Where it standsNo known exploitationCONNECTS TOSame weaknessInformation disclosure (CWE-200)197 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

obsidian-tc: Amber, patch this week. obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) has no vault claim, and the folder access-control list is shared globally. Any va…

The flaws

  • CVE-2026-77364: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default (CVSS 6.5 · EPSS 0%)
  • CVE-2026-77366: Obsidian-tc tokens can access arbitrary configured vaults (CVSS 9.9 · EPSS 0%)
  • CVE-2026-77363: Obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback (CVSS 8.8 · EPSS 0%)
  • CVE-2026-115477: Declined human-in-the-loop confirmations can permit destructive calls over HTTP (CVSS 7.1 · EPSS 0%)

The fix

Upgrade obsidian-tc: 1.3.1 · 1.31.4 or later on your release line

Who is exposed: obsidian-tc (npm) < 1.3.1

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.5 medium
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
obsidian-tcnpm< 1.3.11.3.1

References

Original description

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only during enumeration. An authenticated caller can directly read sensitive files such as .obsidian/plugins/*/data.json, potentially exposing plugin API keys, Obsidian Sync passwords, and other in-vault data. Version 1.3.1 fixes the vulnerability by denying the control directories by default and enforcing strictReadDefault on direct request paths.

Last activity 12 Oct 2026. Patch Forecast updates every hour.