CVE-2026-77364

The obsidian-tc Model Context Protocol server (prior to version 1.3.1 ) contains a vulnerability where undefined readPaths and writePaths settings allow access to all paths. Additionally, strictReadDefault fails to protect direct requests, and control directories like .obsidian, .git, and .trash ...