CVE-2026-77366: obsidian-tc tokens can access arbitrary configured vaults
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) has no vault claim, and the folder access-control list is shared globally. Any valid token can therefore select another configured vault and read, write, or delete its contents through affected tools. Version 1.3.1 fixes the vulnerability by binding tokens and request context to a vault and rejecting mismatched input.vault values before scope checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
obsidian-tcto a version that resolves this vulnerability.Fixed in 1.3.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Any holder of a valid obsidian-tc token can exploit it. The attacker does not need user interaction and can target another vault that is configured on the affected server.
What access could an attacker gain?
An attacker can use affected tools to read, write, or delete content in arbitrary configured vaults. The vulnerability affects confidentiality, integrity, and availability of those vaults.
Are default deployments affected?
The issue applies to affected versions prior to 1.3.1 when multiple vaults are configured and a valid token is available. The flaw is in token and request vault binding rather than a stated optional feature configuration.
What should be done if an immediate upgrade is not possible?
The provided data does not specify a workaround. Reduce exposure by ensuring untrusted parties cannot obtain or use valid tokens and by limiting the set of configured vaults until version 1.3.1 can be deployed.
How can I determine whether an instance is remediated?
Version 1.3.1 is identified as the fix. In the fixed behavior, tokens and request context are bound to a vault, and requests with a mismatched input.vault value are rejected before scope checks.