CVE-2026-77366 The-40-Thieves CVE debrief

Who should care

Administrators and users of Obsidian vaults, particularly those with sensitive data, should verify and update to version 1.3.1 or later to prevent unauthorized access. They should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance, plan vendor-supported updates or mitigations through normal change control where exposure is confirmed, and review compensating controls for exposed systems while remediation is

Why it matters

CVE-2026-77366 allows obsidian-tc tokens to access arbitrary configured vaults, potentially leading to unauthorized access and data breaches. Administrators and users should verify and update to version 1.3.1 or later to prevent exploitation.

• Potential unauthorized access to sensitive data
• Possible data breaches or modifications
• Need for verification and updates to prevent exploitation

Technical summary

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, allowing any valid token to select another configured vault and read, write, or delete its contents through affected tools. This vulnerability can be mitigated by verifying and updating to version 1.3.1 or later, reviewing and restricting access to sensitive vaults, and monitoring for suspicious activity on Obsidian vaults.

Defensive priority

High priority for Obsidian vault administrators and users to verify and update to version 1.3.1 or later.

Recommended defensive actions

• Verify and update obsidian-tc to version 1.3.1 or later
• Review and restrict access to sensitive vaults
• Monitor for suspicious activity on Obsidian vaults
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on potential exploitation or affected systems. To verify and update to version 1.3.1 or later, administrators and users should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. They should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed, review compensating controls for exposed systems while remediation is scheduled and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.