CVE-2026-77364Medium· 6.5▾ Sunlitobsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian,…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.2%
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only during enumeration. An authenticated caller can directly read sensitive files such as .obsidian/plugins/*/data.json, potentially exposing plugin API keys, Obsidian Sync passwords, and other in-vault data. Version 1.3.1 fixes the vulnerability by denying the control directories by default and enforcing strictReadDefault on direct request paths.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
obsidian-tc < 1.3.1Patched in:
obsidian-tc 1.3.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77362Medium· 4.3obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults
CVE-2026-77361Medium· 4.7obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults
CVE-2026-77366Critical· 9.9obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults
CVE-2026-77363High· 8.8obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults
CVE-2026-115477High· 7.1obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
CVE-2026-115478High· 7.1obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes