EUVD-2026-82406Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed tunnel endpoint
-
DeliveryCall /oauth/authorize with no login
-
ExploitExchange code at /oauth/token for VAULT_MCP_TOKEN
-
ExecutionAuthenticate to /mcp with token
-
PersistInvoke vault_read/vault_write/vault_delete
-
ImpactExfiltrate or destroy entire vault
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires only network reachability to a deployed Obsidian Web MCP server prior to version 0.2.0 - specifically an instance exposed through its recommended Cloudflare Tunnel (or any interface reachable to the attacker). No credentials, session, consent, or user interaction are needed because /oauth/authorize issues codes without any login check and /oauth/token returns the static VAULT_MCP_TOKEN without client authentication; optional PKCE does not stop an attacker-initiated flow, and /oauth/register additionally leaks VAULT_OAUTH_CLIENT_SECRET enabling a client_credentials path. LIMITING factors: the vulnerable server is only exploitable if actually reachable by the attacker - in the pre-fix default it may be tunnel-exposed, and post-0.2.0 it binds to 127.0.0.1 and demands VAULT_OAUTH_PASSWORD; instances never exposed beyond loopback are not remotely reachable. |
| Impact | This is a genuine high-priority issue, not an inflated CVSS. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, 9.4) is consistent with the description: /oauth/authorize issues an authorization code with no login, consent, or session check, and /oauth/token exchanges it for the static VAULT_MCP_TOKEN without client authentication (CWE-306, Missing Authentication for a Critical Function). The confirming commit (e4924f0, PR#30, GHSA-hwhg-mrjc-8g43) validates the flaw and its fix by introducing a mandatory VAULT_OAUTH_PASSWORD login that fails closed. No EPSS score, CISA KEV listing, or public POC is provided in the input, so exploitation status is 'no public exploit identified at time of analysis' - the risk is driven by triviality of attack (unauthenticated, single-request path, no user interaction) rather than by observed in-the-wild activity. One important mitigating factor the raw CVSS does not capture: post-fix the server binds to 127.0.0.1 by default, so real-world exposure hinges on the recommended Cloudflare Tunnel deployment actually being reachable - the description itself scopes the threat to 'a caller who can reach the intended tunnel deployment.' The A:L rather than A:H is arguably conservative given vault_delete can destroy the entire vault. |
| Exploit ScenarioDerived | An attacker who can reach a vulnerable Obsidian Web MCP instance (via its Cloudflare Tunnel URL) calls /oauth/authorize to obtain an authorization code with no login prompt, exchanges it at /oauth/token for the static VAULT_MCP_TOKEN, and then invokes /mcp tools to read, search, modify, move, or delete every note in the vault. No public exploit code is identified, but the attack is a handful of scriptable HTTP requests requiring no authentication or user interaction; PKCE and /oauth/register (which leaks VAULT_OAUTH_CLIENT_SECRET) provide no protection. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Unauthenticated OAuth handling in Obsidian Web MCP (obsidian-web-mcp) prior to 0.2.0 lets any remote caller who can reach the deployment obtain the static VAULT_MCP_TOKEN and then invoke vault_read, vault_write, vault_search, vault_list, vault_move, and vault_delete against the entire Obsidian vault. Because /oauth/authorize issues an authorization code with no login, consent, or session check, and /oauth/token exchanges that code for the bearer token without authenticating a client, the flaw carries a CVSS of 9.4 (AV:N/AC:L/PR:N/UI:N, C:H/I:H) and grants full read and write control of personal notes; optional PKCE does not stop an attacker-initiated flow, and /oauth/register additionally returns the configured VAULT_OAUTH_CLIENT_SECRET, exposing a client_credentials path. No CISA KEV listing is present and no public exploit identified at time of analysis - exploitation requires only that the server be network-reachable, which is realistic for instances published through the project's recommended Cloudflare Tunnel.
RemediationAI
Upgrade to the vendor-released patch, obsidian-web-mcp 0.2.0 (https://github.com/jimprosser/obsidian-web-mcp/releases/tag/v0.2.0, containing commit e4924f096ee7494a7999d6c0cceca9be08e48eef and PR #30), which adds a mandatory browser login at /oauth/authorize using VAULT_OAUTH_USERNAME and VAULT_OAUTH_PASSWORD, refuses to authorize any client when VAULT_OAUTH_PASSWORD is unset (fail-closed), and defaults the bind address to 127.0.0.1. Because the pre-0.2.0 endpoints could disclose both the static VAULT_MCP_TOKEN and VAULT_OAUTH_CLIENT_SECRET to any unauthenticated caller, treat those two values as compromised on any instance that ran 0.1.0 while reachable: rotate VAULT_MCP_TOKEN and VAULT_OAUTH_CLIENT_SECRET as part of the upgrade, and set VAULT_OAUTH_PASSWORD to a strong passphrase before exposing the service again. If upgrading immediately is not possible, the most effective compensating control is to stop the vulnerable server from being reachable at all - keep VAULT_MCP_HOST at 127.0.0.1 and remove or disable the Cloudflare Tunnel route, accepting that remote MCP clients (Claude desktop/mobile) will lose connectivity until you upgrade. As a secondary control, layer Cloudflare Access (SSO, device posture, or IP allowlisting) or reverse-proxy rules that deny /oauth/authorize, /oauth/token, and /oauth/register from untrusted sources; the trade-off is that blocking these paths also breaks initial client registration and token refresh, so the deny rules must be scoped to untrusted origins rather than applied globally, and they do not protect /mcp if a bearer token has already leaked. Before restoring service, review vault contents for unauthorized vault_write, vault_move, or vault_delete activity and restore from backup or git history as needed, since the flaw grants full modify capability and no log-based detection is described in the advisory.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Obsidian Web MCP is a Python MCP (Model Context Protocol) server that exposes an Obsidian markdown vault over Streamable HTTP at /mcp/, typically deployed behind a Cloudflare Tunnel so that the host opens no inbound ports. The vulnerability is a CWE-306 missing authentication for a critical function: the OAuth 2.0 authorization-code endpoints were implemented without a human login step, so /oauth/authorize minted authorization codes unconditionally and /oauth/token exchanged them for the static VAULT_MCP_TOKEN without verifying a client or session. Optional PKCE provides no protection because the attacker initiates the flow themselves and therefore controls the code verifier. An unauthenticated /oauth/register endpoint compounded the exposure by returning VAULT_OAUTH_CLIENT_SECRET, enabling a client_credentials grant that bypasses the browser flow entirely. The core library and protocol pieces involved are the MCP Streamable HTTP transport, the OAuth 2.0 authorization-code and client-credentials grants, and PKCE (RFC 7636); the root cause is the absent authentication boundary rather than a parsing or memory-safety defect. No CPE strings were supplied with this record, so the affected package is identified by repository and release rather than by NVD CPE enumeration. The 0.2.0 fix commit (e4924f096ee7494a7999d6c0cceca9be08e48eef) introduces a browser login at /oauth/authorize gated on VAULT_OAUTH_USERNAME/VAULT_OAUTH_PASSWORD, makes the server fail closed when VAULT_OAUTH_PASSWORD is unset, moves dynamic client registration ahead of the browser flow, and changes the default bind address to 127.0.0.1.
Know when Obsidian gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Unauthenticated single-request remote bypass (AV:N/AC:L/PR:N/UI:N) grants full vault read (C:H), write/move (I:H), and vault_delete-driven destruction (A:H, raised from vendor A:L).
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session check, and /oauth/token can exchange that code for the static VAULT_MCP_TOKEN without authenticating a client. An unauthenticated remote caller who can reach the intended tunnel deployment can therefore call /mcp and use vault_read, vault_write, vault_search, vault_list, vault_move, and vault_delete against the entire vault. Optional PKCE does not prevent an attacker-initiated flow, and unauthenticated /oauth/register also exposes a client_credentials path by returning the configured VAULT_OAUTH_CLIENT_SECRET. This issue is fixed in version 0.2.0.
Technical POC Analysis
CWE-306 - Missing Authentication for Critical Function.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Obsidian Web MCP, a self-hosted integration that exposes an Obsidian vault to remote callers, contains a critical unauthenticated flaw (CVE-2026-54618, CVSS 9.4) that allows any party able to reach the deployment to obtain its static vault access token and then read, modify, move, or delete the entire contents of the vault. Because the exposed data is typically personal and business notes, credentials, and intellectual property, leadership should treat any internet-reachable instance as a full loss of confidentiality and integrity until remediated. Affected parties are the teams and individuals who self-hosted this integration, plus any organization whose sensitive material resides in those vaults.
No vendor-released patch identified at time of analysis. Interim mitigations: remove the deployment from public network reachability or restrict it to a trusted IP allowlist; block the /oauth/authorize, /oauth/token, and /oauth/register endpoints at the proxy or application layer; front the service with an authenticated reverse proxy or mutual TLS; rotate VAULT_MCP_TOKEN and VAULT_OAUTH_CLIENT_SECRET and treat prior values as compromised; enable request and vault access logging and monitor for unexpected vault_read, vault_write, vault_list, vault_move, or vault_delete activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is
Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. Rated high severity (CVSS 7.8), this vulnerability is no
An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio an
Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access l
Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. Rated medi
A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to
The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via th
Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs. Rated critical severity (CVSS 9.8),
Arbitrary code execution in Obsidian Desktop builds prior to 1.14.0 is possible when a user opens an attacker-supplied M
Arbitrary operating-system command execution on Obsidian Desktop builds prior to 1.14.0 is possible when a victim opens
Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) v
A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrar
Exploit-DB