CVE-2026-77364

MEDIUM 6.5

obsidian-tc fail-open default ACL exposes Obsidian control-directory secrets

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only during enumeration. An authenticated caller can directly read sensitive files such as .obsidian/plugins/*/data.json, potentially exposing plugin API keys, Obsidian Sync passwords, and other in-vault data. Version 1.3.1 fixes the vulnerability by denying the control directories by default and enforcing strictReadDefault on direct request paths.

CWE	CWE-200 CWE-276
Vendor	the-40-thieves
Product	obsidian-tc
Published	Oct 12, 2026

Stay Ahead of the Next One

Get instant alerts for the-40-thieves obsidian-tc

Be the first to know when new medium vulnerabilities affecting the-40-thieves obsidian-tc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

The-40-Thieves / obsidian-tc

< 1.3.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-cvp8-vvgf-69q4 github.com: https://github.com/The-40-Thieves/obsidian-tc/pull/73 github.com: https://github.com/The-40-Thieves/obsidian-tc/commit/74de320ddea855e1dec47d67beabe88491149dab github.com: https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1