CVE-2026-115477 The-40-Thieves CVE debrief

Who should care

Defenders of obsidian-tc deployments, especially those with 'destructive: true' tools or HITL scopes, should verify exposure and prioritize upgrading to version 1.31.4 or later. They should also review compensating controls for exposed systems, monitor for suspicious activity, and track exceptions.

Why it matters

CVE-2026-115477 allows destructive calls over HTTP in obsidian-tc even after human-in-the-loop confirmations are declined, affecting dispatch-gated tools with 'destructive: true' or HITL scopes. Defenders should verify exposure and prioritize upgrading to version 1.31.4 or later.

• Verify obsidian-tc deployments for exposure to ensure destructive calls are not executed unintentionally.
• Upgrade to version 1.31.4 or later to fix the vulnerability.
• Monitor for suspicious activity related to dispatch-gated tools to detect potential exploitation attempts.

Technical summary

The vulnerability in obsidian-tc allows destructive calls over HTTP even after human-in-the-loop confirmations are declined. This issue affects dispatch-gated tools with 'destructive: true' or a scope with an HITL floor. The server trusts an authentic, call-bound state as proof of approval, which is minted before the elicitation leg is asked. The vulnerability was reproduced directly: a 'destructive: true' tool call, offered 'inputRequired', answered with '{action: decline}' on the 'elicitation/create' leg, still wrote. This issue is present since the 2026-07-28 round trip shipped in v1.13.0 (THE-583).

Defensive priority

Defenders should prioritize verifying exposure of obsidian-tc deployments, especially those with 'destructive: true' tools or HITL scopes, and upgrade to version 1.31.4 or later.

Recommended defensive actions

• Verify obsidian-tc deployments for exposure, especially those with 'destructive: true' tools or HITL scopes.
• Upgrade to version 1.31.4 or later.
• Monitor for suspicious activity related to dispatch-gated tools.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was reproduced directly: a 'destructive: true' tool call, offered 'inputRequired', answered with '{action: decline}' on the 'elicitation/create' leg, still wrote. This issue is present since the 2026-07-28 round trip shipped in v1.13.0 (THE-583).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.