Read Access Control Bypass in Obsidian TC Model Context Protocol Server

CVE-2026-77361

What is CVE-2026-77361?

The Obsidian TC Model Context Protocol server has a vulnerability that allows for read access control bypass due to discrepancies in how access control list (ACL) checks are performed. Specifically, prior to version 1.3.1, the checks relied on a lexical vault-relative path while containment checks used the resolved path. This inconsistency can potentially allow an in-vault symlink, under an allowed glob that resolves into a denied folder, to bypass the read ACL and expose unauthorized files. The issue is mitigated in version 1.3.1, which aligns the ACL checks with the resolved vault-relative path, enhancing the security of the application.

References