CVE-2026-115477

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with auth.jwtSecret configured and a 2026-07-28-era client declaring elicitation.form support, a dispatch-gated tool call offered an inputRequired...