Threat Intelligence Database

A critical authorization bypass vulnerability (CVE-2026-77366) exists in obsidian-tc versions prior to 1.3.1. The flaw allows any valid token to access and manipulate vaults other than the one bound to the caller due to missing vault claim checks in JSON Web Tokens and globally shared folder access-control lists. This enables unauthorized read, write, or deletion of vault contents. Version 1.3.1 addresses the issue by binding tokens and request contexts to specific vaults and rejecting mismatched vault inputs before scope validation.

CVE-2026-77364 is an information exposure vulnerability in obsidian-tc, a Model Context Protocol server for Obsidian vaults. Versions prior to 1.3.1 allow authenticated users to read sensitive files directly due to misconfigured readPaths and writePaths settings and insufficient enforcement of strictReadDefault. This can expose plugin API keys, Obsidian Sync passwords, and other sensitive vault data. The vulnerability is fixed in version 1.3.1 by denying access to control directories by default and enforcing strictReadDefault on direct requests.

CVE-2026-77363 is an origin validation error in obsidian-tc, a Model Context Protocol server for Obsidian vaults. Versions prior to 1.3.1 do not validate Host or Origin headers and lack DNS-rebinding protection in the Streamable HTTP transport. When configured with auth.mode set to none, this allows a malicious web page to send requests to the local MCP endpoint and gain unrestricted vault access. The issue is fixed in version 1.3.1 by enabling host, origin, and DNS-rebinding validation.