CVE Intelligence
Analysis AI-assisted

CVE-2026-77366: obsidian-tc Authorization Bypass via Vault Selection (IDOR)

obsidian-tc versions before 1.3.1 let any valid token select another configured vault through the input.vault value and read, write or delete its contents via affected tools. The CNA rates the issue critical with a CVSS 3.1 base score of 9.9, and the record identifies 1.3.1 as the fixed version. The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

obsidian-tc is a Model Context Protocol server for Obsidian vaults. According to the record, versions before 1.3.1 do not check that the caller-supplied input.vault value matches the vault bound to the caller, so a valid token can direct requests to another configured vault. The weakness is classified as CWE-639 and is described in the GitHub security advisory GHSA-84c9-qqpq-2pq5.

Impact

  • According to the record, any valid token can read, write or delete the contents of other configured vaults through affected tools.
  • The CNA rates the issue critical, with a CVSS 3.1 base score of 9.9 and high confidentiality, integrity and availability impact, with scope changed.
  • The practical impact on a given deployment depends on how many vaults are configured and what they contain (inference).

Affected products and versions

  • The-40-Thieves obsidian-tc, versions before 1.3.1.
  • The record names 1.3.1 as the fixed version, and the v1.3.1 release is referenced.
  • The structured fixes field in the record is empty, so the fix version is taken from the description and the release reference.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted.
  • SSVC fields in the record indicate exploitation none and automatable no. The EPSS probability is 0.00308 (percentile 0.21897) as of 2026-10-13.

Remediation and mitigation

  • Upgrade obsidian-tc to version 1.3.1 or later.
  • After upgrading, consider rotating tokens issued before the fix, since the record states the tokens carried no vault claim (inference).
  • Until the upgrade is applied, limit which clients and tokens can reach the server and reduce the number of configured vaults where practical (inference; the record does not describe a workaround).

Detection guidance

  • Review server and client logs for requests whose vault selection does not match the vault expected for the calling identity.
  • Look for read, write or delete activity against vaults that a given token should not need to access.
  • Treat such findings as items to investigate, not as confirmed compromise.

Limitations of the available information

  • The record provides no technical details beyond its description, no workaround and no information on the number of affected installations.
  • The structured fixes field is empty; the fixed version relies on the description and the release reference.
  • Whether the referenced pull request and commit are the complete remediation is not stated in the record.

Frequently asked questions

Which obsidian-tc versions are affected by CVE-2026-77366?

According to the record, versions before 1.3.1 are affected. The record names 1.3.1 as the version that fixes the issue.

Is there confirmed exploitation of this vulnerability?

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted. Organizations should still upgrade promptly given the critical rating.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.