PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-77364 The-40-Thieves CVE debrief

An authenticated caller can directly read sensitive files such as .obsidian/plugins/*/data.json, potentially exposing plugin API keys, Obsidian Sync passwords, and other in-vault data. This vulnerability allows unauthorized access to sensitive information in Obsidian vaults using obsidian-tc prior to version 1.3.1. The vulnerability stems from undefined readPaths and writePaths settings, allowing all paths, and strictReadDefault not protecting direct requests. The .obsidian, .git, and .trash control directories are excluded only during enumeration.

Vendor
The-40-Thieves
Product
obsidian-tc
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-12
Original CVE updated
2026-10-12
Advisory published
2026-10-12
Advisory updated
2026-10-12

Who should care

Defenders of Obsidian vaults using obsidian-tc should assess exposure and prioritize upgrading to version 1.3.1 or later to prevent potential exposure of sensitive data. This includes operators, security teams, and administrators responsible for maintaining Obsidian vaults and ensuring the security of sensitive information within them.

Why it matters

Defenders of Obsidian vaults using obsidian-tc should assess exposure and prioritize upgrading to version 1.3.1 or later to prevent potential exposure of sensitive data.

  • Potential exposure of plugin API keys
  • Potential exposure of Obsidian Sync passwords
  • Potential exposure of other in-vault data
  • Verification of Obsidian control-directory secrets exposure

Technical summary

Prior to version 1.3.1, obsidian-tc has undefined readPaths and writePaths settings, allowing all paths, and strictReadDefault does not protect direct requests. This allows an authenticated caller to directly read sensitive files such as .obsidian/plugins/*/data.json. The vulnerability was addressed in version 1.3.1 of obsidian-tc by denying the control directories by default and enforcing strictReadDefault on direct request paths. Defenders should assess the vulnerability and consider upgrading to the fixed version.

Defensive priority

Defenders should prioritize verifying exposure of Obsidian control-directory secrets and upgrading to version 1.3.1 or later.

Recommended defensive actions

  • Verify exposure of Obsidian control-directory secrets
  • Upgrade to version 1.3.1 or later
  • Review and restrict access to sensitive files
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected version and fixed version. The vulnerability was addressed in version 1.3.1 of obsidian-tc. Defenders should verify exposure of Obsidian control-directory secrets and consider upgrading to the fixed version. Evidence is limited to public CVE details and source item information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-77364 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-77364

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-77364 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-77364

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • obsidian-tc fail-open default ACL exposes Obsidian control-directory secrets

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77364.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-cvp8-vvgf-69q4

    Supplemental source - x_refsource_CONFIRM

  • Source reference

    Unverified legacy reference

    URL: https://github.com/The-40-Thieves/obsidian-tc/pull/73

    Supplemental source - x_refsource_MISC

  • Source reference

    Unverified legacy reference

    URL: https://github.com/The-40-Thieves/obsidian-tc/commit/74de320ddea855e1dec47d67beabe88491149dab

    Supplemental source - x_refsource_MISC

  • Source reference

    Unverified legacy reference

    URL: https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1

    Supplemental source - x_refsource_MISC

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.