CVE-2026-77362

Prior to version 1.3.1 , the obsidian-tc Model Context Protocol server for Obsidian vaults fails to consistently apply the read access-control list (ACL) to all returned fields. Specifically, the tasks_filter tool exposes group counts from denied notes, makemd_query passes unfiltered sibling resu...

CVE-2026-77362 obsidian-tc bridge tools expose data outside the read ACL

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list ACL to every returned field. The tasksfilter tool exposes group counts derived from denied notes, makemdquery passes...