CVE-2026-115478 The-40-Thieves CVE debrief

Who should care

Defenders responsible for maintaining obsidian-tc installations should be aware of this vulnerability and take steps to verify their exposure and mitigate potential impact. This includes assessing the version of obsidian-tc in use and updating to version 1.31.4 or later if necessary.

Why it matters

Defenders should prioritize verifying the affected versions of obsidian-tc in their environment and updating to version 1.31.4 or later. They should also assess their exposure to potential data loss or corruption and implement compensating controls to mitigate the impact. The evidence from the source item and CVE Program record indicates that the vulnerability is caused by the memory-lifecycle tools in obsidian-tc, but the scope of affected systems and the extent of potential impact require further verification.

• Data loss or corruption due to overwriting of unowned notes
• Inconsistent state due to partial commitment of lifecycle changes
• Potential for refused note writes to leave relations gone or retired status committed

Technical summary

The vulnerability is caused by the memory-lifecycle tools in obsidian-tc regenerating a memory note's body from SQLite at a computed path. When a note already exists at that path and is not owned by the entity being written, its entire body is overwritten, keeping only its frontmatter. Additionally, some tools insert or remove their SQLite row before the fallible filesystem step, which can lead to inconsistent state if the note write is refused.

Defensive priority

Defenders should prioritize verifying the affected versions of obsidian-tc in their environment and updating to version 1.31.4 or later. They should also assess their exposure to potential data loss or corruption and implement compensating controls to mitigate the impact.

Recommended defensive actions

• Verify the version of obsidian-tc in use and update to version 1.31.4 or later if necessary
• Assess exposure to potential data loss or corruption and implement compensating controls
• Monitor for any suspicious activity related to the affected tools
• Perform a thorough review of system logs to detect potential security incidents
• Implement additional monitoring and detection controls to identify potential security threats
• Conduct a thorough asset inventory to identify all affected systems
• Review and update incident response plans to address potential security incidents related to this vulnerability

Evidence notes

The vulnerability is described in the source item from osv_dev, which provides details on the affected tools and the potential impact. The CVE Program record and NVD vulnerability detail pages provide additional context and metadata.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.