Obsidian-TC Critical Flaw Lets Attackers Access Any Vault Before 1.3.1

A critical authorization vulnerability in The-40-Thieves obsidian-tc allows attackers to access any configured vault using a single valid token. The flaw, identified as CVE-2026-77366, carries a CVSS score of 9.9 and affects all versions prior to 1.3.1. This means organizations using the Model Context Protocol server for Obsidian vaults face immediate risk of data theft or destruction if they have not updated their software.

What is the technical root cause of this vulnerability?

The core issue lies in how obsidian-tc handles tool dispatch and access control. According to the NVD record, the server does not compare the caller-controlled input.vault value with the vault actually bound to the caller. Additionally, the JSON Web Token (JWT) used for authentication lacks a specific vault claim. This design choice means that the identity verification mechanism fails to restrict access to the intended data container.

How does an attacker exploit this flaw?

Because the folder access-control list is shared globally, any valid token can select another configured vault. An attacker with one valid token can therefore read, write, or delete contents in any other vault configured on the server. The NVD describes this as a failure to enforce scope checks before allowing tool execution. This allows for full compromise of data integrity and confidentiality across all vaults managed by the instance.

Which specific versions and components are affected?

The vulnerability affects obsidian-tc versions prior to 1.3.1 developed by The-40-Thieves. The NVD record lists the weaknesses as CWE-639 and CWE-863. The product is described as a governed, agent-ready Model Context Protocol server for Obsidian vaults. Users running any version below 1.3.1 are exposed to this critical risk until they apply the vendor's fix.

What is the current status of the fix?

Version 1.3.1 fixes the vulnerability by binding tokens and request context to a specific vault. The updated code rejects mismatched input.vault values before performing scope checks. This ensures that a token can only access the vault it was issued for. Organizations should verify their current version and upgrade to 1.3.1 or later immediately to mitigate this critical exposure.

Background: CVSS score

The Common Vulnerability Scoring System assigns a numerical value to software flaws based on how easy they are to exploit and how much damage they cause. It uses a standardized formula so teams can compare risks across different products. The base score reflects the vulnerability itself, while temporal and environmental scores adjust for real-world conditions like patches or network exposure.

Read the full guide: CVSS Score Explained: What the Number Actually Means for Your Code

What to do and how to stay safe: obsidian-tc

• Audit your obsidian-tc installation to confirm you are running version 1.3.1 or higher.
• Review server logs for any unusual tool dispatch activity or access to unexpected vaults.
• Rotate all JSON Web Tokens and API keys to invalidate any potentially compromised credentials.
• Implement network segmentation to limit access to the Model Context Protocol server endpoints.

Step-by-step guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-77366?

It is a critical authorization flaw in obsidian-tc prior to version 1.3.1 that allows any valid token to access any configured vault.

How severe is this vulnerability?

The NVD rates it as Critical with a CVSS score of 9.9 due to the potential for full data compromise.

Does the fix require configuration changes?

Updating to version 1.3.1 automatically enforces vault binding and rejects mismatched inputs, resolving the issue.