Model Context Protocol Server Vulnerability in Obsidian Vaults from The 40 Thieves

CVE-2026-77366

What is CVE-2026-77366?

The obsidian-tc model context protocol server from The 40 Thieves contains an improper input validation vulnerability, which allows a malicious actor to exploit caller-controlled input values. Prior to version 1.3.1, the tool dispatch mechanism does not validate the input.vault against the vault associated with the caller. Additionally, the JSON Web Token lacks a vault claim, enabling any valid token to access and manipulate another configured vault's contents without proper authorization. The vulnerability has been mitigated in version 1.3.1, which enforces binding tokens and request contexts to specific vaults and includes checks to reject mismatched input values.

References