AdvisoriesToolsStatsChecklistSubmitGet the email
← All advisories
CVE-2026-77366criticalBroken access control2026-10-12

CVE-2026-77366: obsidian-tc MCP server let any token read and edit any vault

Before 1.3.1, the obsidian-tc MCP server for Obsidian never checked the vault a request named against the vault the caller's token was for, so any valid token could read, write or delete notes in every configured vault.

01.

What it is

Tool dispatch trusted the caller-supplied input.vault value, the JWT had no vault claim, and the folder access list was shared across vaults.

The maintainers say this defeated multi-tenant isolation across about 90 tool call sites; only resources/read already had the check.

1.3.1 adds a central input.vault === ctx.vaultId check before the scope check.

02.

How to check

  1. Affected: obsidian-tc (npm) < 1.3.1. The fix was made on a v1.3.0 tag that never shipped to npm, so 1.3.1 is the first fixed release.
  2. This matters most if one server process serves several vaults or users.
03.

How to fix

  1. Upgrade obsidian-tc to 1.3.1 or later.
  2. Until then, run one vault per server process, or give each tenant its own process and credentials.
npm ls obsidian-tc
04.

Sources

More advisories for this tool
The weekly email

One email a week. Only what changed.

Every new security hole in AI coding tools, MCP servers, app builders and the stacks they generate (Next.js, Supabase, Node, PHP), each with how to check your app and the fix. No roundups of things you already read.

Free, one email a week. Read the latest issue first if you like. One-click unsubscribe in every email. We never sell or share addresses.