Model Context Protocol Server Vulnerability in Obsidian Vaults by The 40 Thieves
CVE-2026-115477

7.1HIGH

Key Information:

Vendor

The-40-thieves

Status
Obsidian-tc
Vendor
CVE Published:
23 October 2026

What is CVE-2026-115477?

The vulnerability in obsidian-tc allows malicious clients to execute operations that ordinarily require human approval without the user's consent. This occurs when a client incorrectly reports state due to a flaw in how the server processes resubmissions. Even though a confirmation step was designed, the absence of proper verification allows for dangerous actions like write_note overwrite and move_note to be executed without explicit user cooperation. The issue affects specific versions in a Streamable HTTP deployment with certain configurations, with the fix introduced in version 1.31.4.

Affected Version(s)

obsidian-tc >= 1.13.0, < 1.31.4

References

https://github.com/The-40-Thieves/obsidian-tc/security/ad...
x_refsource_CONFIRM
https://github.com/The-40-Thieves/obsidian-tc/issues/967
x_refsource_MISC
https://github.com/The-40-Thieves/obsidian-tc/pull/969
x_refsource_MISC

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.