CVE-2026-77364: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in The-40-Thieves obsidian-tc
Description
CVE-2026-77364 is an information exposure vulnerability in obsidian-tc, a Model Context Protocol server for Obsidian vaults. Versions prior to 1.3.1 allow authenticated users to read sensitive files directly due to misconfigured readPaths and writePaths settings and insufficient enforcement of strictReadDefault. This can expose plugin API keys, Obsidian Sync passwords, and other sensitive vault data. The vulnerability is fixed in version 1.3.1 by denying access to control directories by default and enforcing strictReadDefault on direct requests.
CVSS v3.1
Score 6.5medium
Affected software
The-40-Thieves
obsidian-tc
pkg:github/the-40-thieves/obsidian-tcRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Obsidian-tc versions before 1.3.1 have a vulnerability where undefined readPaths and writePaths settings allow all paths to be accessed, and the strictReadDefault setting does not protect direct requests. Additionally, control directories such as .obsidian, .git, and .trash are excluded only during enumeration, not direct access. An authenticated attacker can exploit this to read sensitive files like .obsidian/plugins/*/data.json, potentially exposing plugin API keys, Obsidian Sync passwords, and other confidential in-vault data. The issue is resolved in version 1.3.1 by denying access to these control directories by default and enforcing strictReadDefault on direct request paths.
Potential Impact
An authenticated user can read sensitive files within the vault, including plugin API keys and passwords, leading to potential unauthorized access to confidential data. The confidentiality of in-vault data is compromised, but integrity and availability are not affected.
Mitigation Recommendations
Upgrade obsidian-tc to version 1.3.1 or later, where the vulnerability is fixed by default denial of control directories and enforcement of strictReadDefault on direct requests. No additional mitigation is required if running version 1.3.1 or newer.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-20T19:28:35.245Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acd21152cdf04f656bc8d9e
Added to database: 10/12/2026, 18:04:05 UTC
Last enriched: 10/12/2026, 18:18:32 UTC
Last updated: 10/12/2026, 18:57:55 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.