CVE-2026-77366

The obsidian-tc Model Context Protocol server is vulnerable to an authorization bypass in versions prior to 1.3.1 . The flaw occurs because tool dispatch fails to verify that the caller-controlled input.vault value matches the vault bound to the caller, compounded by a lack of vault claims in the...