obsidian-tc: Cross-vault access via tool vault argument
Summary
obsidian-tc is a Model Context Protocol server that gives AI agents access to Obsidian vaults. Before version 1.3.1, any valid token could name another configured vault in the vault argument of tool calls and read, write, or delete its contents, because the token was not bound to a vault and the folder access control list was global. Exploitation requires a valid token and a server with multiple configured vaults reachable over the HTTP transport; the CVSS base score is 9.9 (critical) according to the CNA record.
Affected
- obsidian-tc versions below 1.3.1 (npm package)
- Multi-vault deployments are most at risk
- Single-vault deployments show little cross-vault impact (inference)
Fixed in
- Fixed in 1.3.1 (first published release with the fix)
- Later releases of the 1.3 line also contain the fix; verify the current npm latest version before upgrading
- Fix commit 38b4992
Workaround
- Unknown. No vendor-confirmed workaround. Unverified third-party text suggests running a separate vault per server process.
- Restrict who holds valid tokens and disable the HTTP transport if it is not needed (own inference, not vendor guidance).
Exploitation
- No public proof of concept or exploitation in the wild found at time of analysis.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS 0.00309 (low).
Our recommendation
- Check whether any obsidian-tc instance runs a version below 1.3.1 (npm ls, container image tags, CLI version).
- Upgrade to the latest release, not only 1.3.1, and verify it against the npm registry.
- Check whether the HTTP transport is enabled or reachable beyond localhost; disable it or restrict it with authentication and network controls if not needed.
- After upgrading, issue tokens with a vault claim for each vault in multi-vault deployments; claimless tokens are confined to the default vault.
- Review logs for requests where the vault argument differs from the token's vault, if logging exists.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-84c9-qqpq-2pq5 github.com
- Fix commit 38b4992 github.com
- Pull Request #72 github.com
- Release v1.3.1 github.com
- GitLab Advisory CVE-2026-77366 advisories.gitlab.com
- OSV CVE-2026-77366 osv.dev
- VulDB 417139 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:31.
Original description (NVD)
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) has no vault claim, and the folder access-control list is shared globally. Any valid token can therefore select another configured vault and read, write, or delete its contents through affected tools. Version 1.3.1 fixes the vulnerability by binding tokens and request context to a vault and rejecting mismatched input.vault values before scope checks.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.