obsidian-tc CVE-2026-115477

Exploitable only when ALL hold: the server runs the Streamable HTTP transport; auth.jwtSecret is configured (this is what enables the requestState codec and the inputRequired round trip); the connected client is a 2026-07-28-era client that declared elicitation.form support; and the called tool is dispatch-gated (destructive:true or a scope carrying an HITL floor). The acting client must be malicious, attacker-controlled, or behaving incorrectly, and must echo the validly-bound requestState on resubmission after the human declined, cancelled, or omitted/malformed the response. Limiting factors that exclude many deployments: stdio deployments or any deployment leaving auth.jwtSecret unset are NOT affected (they fall back to the CLI elicit_token path and never offer this requestState round trip); the sixteen handler-side conditionally gated tools (write_note overwrite, move_note, etc.) are NOT reachable via this bypass; and the caller still needs its ordinary JWT-authenticated tool permissions. Only versions 1.13.0 through 1.31.3 are vulnerable.

This is CWE-285/CWE-863 authorization-bypass of a human-in-the-loop (HITL) confirmation gate, scored CVSS 4.0 7.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L). The signals are internally consistent: network vector over Streamable HTTP, low complexity, VI:H reflecting destructive vault operations (delete, cross-folder move, frontmatter/link rewrite), and PR:L because the caller still needs its ordinary JWT-authenticated tool permissions. No EPSS score was supplied in the input, and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation - exploitation status is best described as a maintainer-reproduced defect rather than in-the-wild abuse. The vuln.today decision label is 'this_week' (not act_now/emergency), which matches a serious-but-not-crisis posture. The key nuance that lowers real-world risk below what AV:N/AC:L suggests is the trust model: the bypass is only reachable by a client that is itself malicious or under attacker control (or a compliant client misbehaving); it is not a classic remote-unauthenticated internet exploit against arbitrary victims - the attacker must already be the agent/client talking to the server with valid credentials. Critically, the advisory states the fix does NOT fully close the problem: a malicious or non-compliant client can still answer its own elicitation/create leg with a fabricated approval, because the server cannot verify a human ever saw the form - this residual is inherent to the client-driven 2026-07-28 protocol. Scope is further bounded: only dispatch-gated tools (destructive:true or an HITL-floored scope) were reachable; the sixteen handler-side conditionally gated tools (write_note overwrite, move_note) never read elicitation state on the modern wire and were not bypassable this way.

An Obsidian-vault MCP server is deployed over Streamable HTTP with auth.jwtSecret set, and an AI agent (a 2026-07-28-era client declaring elicitation.form support) that is attacker-controlled or misbehaving calls a destructive, dispatch-gated tool. The server offers an inputRequired confirmation; the human declines or cancels, but the client resubmits the same call echoing the validly-bound requestState, which the pre-1.31.4 server trusted as proof of approval, so the destructive vault operation completes anyway. The defect was reproduced directly by the maintainer (decline on the elicitation/create leg still wrote), but no standalone weaponized exploit is published.