Vulnerability in Model Context Protocol Server for Obsidian Vaults Affects Sensitive Data Access
CVE-2026-77364

6.5MEDIUM

Key Information:

Vendor

The-40-thieves

Status
Obsidian-tc
Vendor
CVE Published:
12 October 2026

What is CVE-2026-77364?

The obsidian-tc Model Context Protocol server, used for managing Obsidian vaults, experiences a vulnerability that allows authenticated users to access sensitive files directly. The issue arises from misconfigured readPaths and writePaths settings, along with inadequate protections for direct requests to control directories, including .obsidian, .git, and .trash. This flaw could lead to unauthorized access to files such as data.json, potentially disclosing sensitive information like plugin API keys and Obsidian Sync passwords. Version 1.3.1 addresses these issues by enhancing security measures, including strict default settings and improved access controls.

Affected Version(s)

obsidian-tc < 1.3.1

References

https://github.com/The-40-Thieves/obsidian-tc/security/ad...
x_refsource_CONFIRM
https://github.com/The-40-Thieves/obsidian-tc/pull/73
x_refsource_MISC
https://github.com/The-40-Thieves/obsidian-tc/commit/74de...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.