Authorization Bypass

obsidian-tc is vulnerable to authorization bypass. The vulnerability is due to insufficient validation of the caller-controlled vault identifier, missing vault binding in JWTs, and globally shared folder access controls, which allows an attacker with a valid token to read, modify, or delete...

GHSA-R3G7-R4HR-M258 obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

Summary createentity, linkentities, renameentity, unlinkentities and deleteentity regenerate a memory note's body from SQLite at the computed memory//.md path. When a note already existed at that path and was not owned by the entity being written a hand-authored note, or an orphan left by a...

npm: obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

npm: obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes vulnerability discovered by ? in WordPress npm obsidian-tc versions = 1.0.1, = 1.31.3...

obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

Summary createentity, linkentities, renameentity, unlinkentities and deleteentity regenerate a memory note's body from SQLite at the computed memory//.md path. When a note already existed at that path and was not owned by the entity being written a hand-authored note, or an orphan left by a...

EUVD-2026-97733

obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback...

obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

Impact The Streamable HTTP transport was constructed without enableDnsRebindingProtection/allowedHosts/allowedOrigins and performed no Origin-header validation. With the documented auth.mode: "none" loopback default, a drive-by web page could POST http://127.0.0.1/mcp and receive caller http-loca...

npm: obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

npm: obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback vulnerability discovered by ? in WordPress npm obsidian-tc versions 1.3.1...

GHSA-PQH8-4PJ7-32XX obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

Impact The Streamable HTTP transport was constructed without enableDnsRebindingProtection/allowedHosts/allowedOrigins and performed no Origin-header validation. With the documented auth.mode: "none" loopback default, a drive-by web page could POST http://127.0.0.1/mcp and receive caller http-loca...

GHSA-43R2-C7G8-PRC8 obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

Impact Bridge tool results filtered only the items array against the read ACL and passed sibling fields through unfiltered: tasksfilter emitted groups whose counts reflected denied notes, makemdquery returned ...result siblings, and listtemplates enumerated Templater template paths and parsed...

npm: obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

npm: obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields vulnerability discovered by ? in WordPress npm obsidian-tc versions 1.3.1...

obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

Impact Bridge tool results filtered only the items array against the read ACL and passed sibling fields through unfiltered: tasksfilter emitted groups whose counts reflected denied notes, makemdquery returned ...result siblings, and listtemplates enumerated Templater template paths and parsed...

EUVD-2026-98689

obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields...

npm: obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP

npm: obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP vulnerability discovered by ? in WordPress npm obsidian-tc versions = 1.13.0, = 1.31.3...

GHSA-737X-CWFR-5VVC obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP

Summary On a Streamable HTTP deployment with auth.jwtSecret configured, serving a 2026-07-28-era client that declared elicitation.form support, a call to a dispatch-gated tool destructive: true, or a scope with an HITL floor that was offered an inputRequired confirmation could still complete afte...

npm: obsidian-tc tokens can access arbitrary configured vaults

npm: obsidian-tc tokens can access arbitrary configured vaults vulnerability discovered by ? in WordPress npm obsidian-tc versions 1.3.1...

EUVD-2026-97737

obsidian-tc tokens can access arbitrary configured vaults...

GHSA-84C9-QQPQ-2PQ5 obsidian-tc tokens can access arbitrary configured vaults

Impact Tool dispatch did not check the caller-supplied input.vault against the caller's bound vault ctx.vaultId; the folder ACL was a single global instance and the JWT carried no vault claim. As a result, any valid token could read, write, or delete any configured vault by passing input.vault,...

obsidian-tc tokens can access arbitrary configured vaults

Impact Tool dispatch did not check the caller-supplied input.vault against the caller's bound vault ctx.vaultId; the folder ACL was a single global instance and the JWT carried no vault claim. As a result, any valid token could read, write, or delete any configured vault by passing input.vault,...

npm: obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default

npm: obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default vulnerability discovered by ? in WordPress npm obsidian-tc versions 1.3.1...

GHSA-CVP8-VVGF-69Q4 obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default

Impact With a default configuration, an undefined readPaths/writePaths meant allow-all, the strictReadDefault flag was inert, and the .obsidian/.git/.trash control directories were denied only during enumeration — not on the direct request path. A caller could read .obsidian/plugins//data.json,...