CVE-2026-77361: CWE-59: Improper Link Resolution Before File Access ('Link Following') in The-40-Thieves obsidian-tc
Description
CVE-2026-77361 is a medium severity vulnerability in obsidian-tc, a Model Context Protocol server for Obsidian vaults. Versions prior to 1.3.1 improperly handle symbolic links in access control checks, allowing read access to files in denied folders via a symlink planted out-of-band. The vulnerability does not allow escaping the vault root. Version 1.3.1 fixes this by applying ACL checks to the resolved vault-relative path.
CVSS v3.1
Score 4.7medium
Affected software
The-40-Thieves
obsidian-tc
pkg:github/the-40-thieves/obsidian-tcRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In obsidian-tc versions before 1.3.1, read access control list (ACL) checks use a lexical vault-relative path, while containment checks use the resolved path. This discrepancy allows an attacker to place a symbolic link inside the vault that points to a denied folder, bypassing the read ACL and exposing files in that folder. Exploitation requires the attacker to plant the symlink out-of-band and does not permit vault root escape. The issue is fixed in version 1.3.1 by applying ACL checks to the resolved vault-relative path.
Potential Impact
An attacker with the ability to plant a symbolic link inside the vault can bypass read ACL restrictions to access files in folders that should be denied. This results in unauthorized read access to sensitive files within the vault, but does not allow privilege escalation or vault root escape.
Mitigation Recommendations
Upgrade obsidian-tc to version 1.3.1 or later, which fixes the vulnerability by applying ACL checks to the resolved vault-relative path. No other mitigation is required as the fix is official and available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-20T19:28:35.245Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ace3de02cdf04f656720e7c
Added to database: 10/13/2026, 14:19:12 UTC
Last enriched: 10/13/2026, 14:33:52 UTC
Last updated: 10/13/2026, 14:34:03 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.