CVE-2026-77364: obsidian-tc fail-open default ACL exposes Obsidian control-directory secrets
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only during enumeration. An authenticated caller can directly read sensitive files such as .obsidian/plugins//data.json, potentially exposing plugin API keys, Obsidian Sync passwords, and other in-vault data. Version 1.3.1 fixes the vulnerability by denying the control directories by default and enforcing strictReadDefault on direct request paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
obsidian-tcto a version that resolves this vulnerability.Fixed in 1.3.1
Event History
Frequently Asked Questions
Which deployments are exposed?
obsidian-tc deployments prior to version 1.3.1 are exposed when callers can authenticate to the server. Undefined readPaths and writePaths settings allow all paths, and direct requests can bypass protections intended for enumeration.
What does an attacker need to exploit this issue?
An attacker needs authenticated access to obsidian-tc and must be able to make direct file-read requests. No user interaction is required.
What information could be disclosed?
An authenticated caller may directly read files in .obsidian, .git, and .trash, including .obsidian/plugins/*/data.json. Exposed data can include plugin API keys, Obsidian Sync passwords, and other data stored in the vault.
What should be done if an immediate upgrade is not possible?
Restrict authenticated access to trusted callers and avoid leaving readPaths and writePaths undefined, since undefined settings allow all paths. Treat control-directory contents as potentially exposed and rotate any secrets stored there if unauthorized access is suspected.
How can I tell whether the fix is present?
Version 1.3.1 denies the control directories by default and enforces strictReadDefault for direct request paths. Versions earlier than 1.3.1 do not have the described fix.