CVE-2026-77366 debrief: obsidian-tc tokens can access arbitrary configured vaults due to improper validation of input.vault values, allowing unauthorized access to sensitive data. This vulnerability affects obsidian-tc, a governed, agent-ready Model Context Protocol server for Obsidian vaults. The issue arises from the tool dispatch not comparing the caller-controlled input.vault value with the vault boun [truncated]
An authenticated caller can directly read sensitive files such as .obsidian/plugins/*/data.json, potentially exposing plugin API keys, Obsidian Sync passwords, and other in-vault data. This vulnerability allows unauthorized access to sensitive information in Obsidian vaults using obsidian-tc prior to version 1.3.1. The vulnerability stems from undefined readPaths and writePaths settings, allowing all path [truncated]
CVE-2026-77363 debrief based on obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access. The CVE record was published on 2026-10-12T17:45:57.107Z and has not been modified since then. This vulnerability affects obsidian-tc, a governed, agent-ready Model Context Protocol server for Obsidian vaults. The Streamable HTTP transport does not validate the Host or Origin header or enable [truncated]
