CVE-2026-77364
6.5MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-200, CWE-276
Impact
Authenticated callers can read sensitive vault files directly, including plugin API keys and Obsidian Sync passwords. They only need standard authenticated API access to the obsidian-tc MCP server.
Root cause
Control directories like .obsidian, .git, and .trash were only excluded during enumeration, while strictReadDefault was not enforced on direct read requests and unconfigured paths defaulted to allowing all access.
Affected systems
obsidian-tc prior to 1.3.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade obsidian-tc to version 1.3.1 or later. If patching immediately is not possible, explicitly configure restrictive readPaths and writePaths to disallow access to control directories like .obsidian.
$ npm install obsidian-tc@1.3.1AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only during enumeration. An authenticated caller can directly read sensitive files such as .obsidian/plugins/*/data.json, potentially exposing plugin API keys, Obsidian Sync passwords, and other in-vault data. Version 1.3.1 fixes the vulnerability by denying the control directories by default and enforcing strictReadDefault on direct request paths.