AdvisoriesToolsStatsChecklistSubmitGet the email
← All advisories
CVE-2026-54618criticalBroken access control2026-09-17

CVE-2026-54618: Obsidian Web MCP hands out vault access without a login

Before 0.2.0, Obsidian Web MCP's /oauth/authorize issues an authorization code with no login or consent, and /oauth/token swaps it for the static VAULT_MCP_TOKEN. Anyone who can reach the tunnel can read, write, move and delete notes in the whole vault.

01.

What it is

/oauth/authorize auto-approves and issues an authorization code without any login, consent or session check, and /oauth/token exchanges that code for the static VAULT_MCP_TOKEN without authenticating the client.

With that token, an unauthenticated remote caller who can reach the intended tunnel deployment can call /mcp and use vault_read, vault_write, vault_search, vault_list, vault_move and vault_delete against the entire vault. Optional PKCE doesn't stop an attacker-started flow.

02.

How to check

  1. Affected: jimprosser/obsidian-web-mcp 0.1.0 and earlier.
  2. Check whether your instance is exposed through a tunnel or public URL.
03.

How to fix

  1. Upgrade to obsidian-web-mcp 0.2.0 or later.
  2. Change VAULT_MCP_TOKEN after upgrading, and review the vault for unexpected edits or deletions if it was exposed.
git -C obsidian-web-mcp describe --tags
04.

Sources

More advisories for this tool
The weekly email

One email a week. Only what changed.

Every new security hole in AI coding tools, MCP servers, app builders and the stacks they generate (Next.js, Supabase, Node, PHP), each with how to check your app and the fix. No roundups of things you already read.

Free, one email a week. Read the latest issue first if you like. One-click unsubscribe in every email. We never sell or share addresses.