Obsidian-tc Bridge Tools Leak Denied-note Data Via Unfiltered Sibling Fields

Impact Bridge tool results filtered only the "items" array against the read ACL and passed sibling fields through unfiltered: "tasksfilter" emitted "groups" whose counts reflected denied notes, "makemdquery" returned "...result" siblings, and "listtemplates" enumerated Templater template paths an...

obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

Impact Bridge tool results filtered only the items array against the read ACL and passed sibling fields through unfiltered: tasksfilter emitted groups whose counts reflected denied notes, makemdquery returned ...result siblings, and listtemplates enumerated Templater template paths and parsed...

GHSA-43R2-C7G8-PRC8 obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

Impact Bridge tool results filtered only the items array against the read ACL and passed sibling fields through unfiltered: tasksfilter emitted groups whose counts reflected denied notes, makemdquery returned ...result siblings, and listtemplates enumerated Templater template paths and parsed...

EUVD-2026-98689

obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields...

CVE-2026-77362

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list ACL to every returned field. The tasksfilter tool exposes group counts derived from denied notes, makemdquery passes...

CVE-2026-77362

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list ACL to every returned field. The tasksfilter tool exposes group counts derived from denied notes, makemdquery passes...

CVE-2026-77362

Prior to version 1.3.1 , the obsidian-tc Model Context Protocol server for Obsidian vaults fails to consistently apply the read access-control list (ACL) to all returned fields. Specifically, the tasks_filter tool exposes group counts from denied notes, makemd_query passes unfiltered sibling resu...

CVE-2026-77362 obsidian-tc bridge tools expose data outside the read ACL

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list ACL to every returned field. The tasksfilter tool exposes group counts derived from denied notes, makemdquery passes...

CVE-2026-77362 obsidian-tc bridge tools expose data outside the read ACL

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list ACL to every returned field. The tasksfilter tool exposes group counts derived from denied notes, makemdquery passes...

CVE-2026-77362: Exposure of Sensitive Information to an Unauthorized Actor

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list ACL to every returned field. The tasksfilter tool exposes group counts derived from denied notes, makemdquery passes...

The-40-Thieves obsidian-tc information leakage vulnerability

The The-40-Thieves obsidian-tc version prior to 1.3.1 has security vulnerabilities. These vulnerabilities stem from the bridge tool not applying a read access control list to each returned field consistently. The tasksfilter tool exposes the group count for notes that are denied access. The...