obsidian-tc EUVD-2026-97736

Exploitation requires an authenticated caller to the obsidian-tc MCP server (PR:L) issuing a direct file request (e.g. read_note) rather than enumeration. The flaw is present in default/back-compat configurations where readPaths and writePaths are undefined (allow-all) in versions prior to 1.3.1; the pre-fix strictReadDefault setting was silently stripped by config validation, so even operators who set it gained no protection on the request path. Control directories (.obsidian, .git, .trash) were filtered only during enumeration, not on direct paths, so '.obsidian/plugins/*/data.json' and similar were directly readable. Limiting factors: the attacker must already hold valid authentication to the server, and no code execution or data modification is possible - impact is confined to confidentiality.

This is a genuine but moderate-priority information-disclosure flaw (CWE-200), not an overblown high-CVSS issue. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) is consistent with the description: a network-reachable MCP server where an already-authenticated caller can read secrets, with high confidentiality impact but zero integrity or availability impact. No EPSS score was provided, so statistical exploitation probability cannot be weighed. The vulnerability is NOT in CISA KEV and no public exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis' - though the fix commit (74de320) and GHSA-cvp8-vvgf-69q4 publicly document the exact trigger (read_note('.obsidian/plugins/*/data.json')), which lowers the bar for a trivial reproduction. No SSVC decision data was supplied. The key limiting factor is PR:L: the attacker must already be an authenticated caller of the MCP server, which reduces real-world urgency from 'drop everything' to 'patch promptly, especially in multi-tenant or shared-agent deployments.' Signals are internally consistent - no conflicts between the CVSS vector and the description.

An authenticated user (or a compromised/over-privileged AI agent) connected to the obsidian-tc MCP server calls read_note with a direct path such as '.obsidian/plugins/<plugin>/data.json', bypassing the enumeration-only directory filter. Because undefined readPaths default to allow-all and strictReadDefault was not enforced on direct requests, the server returns the file contents, exposing plugin API keys and Obsidian Sync passwords. No public exploit is referenced, but the fix commit explicitly documents the exact vulnerable call pattern.