obsidian-tc EUVD-2026-98689

Exploitation requires (1) an authenticated caller with access to the obsidian-tc MCP server (PR:L), and (2) a read whitelist / read ACL being configured on the vault - the patch explicitly states 'No change when no read whitelist is configured,' so deployments without a read whitelist are not affected. The specific vulnerable surfaces are the tasks_filter tool (leaks group counts aggregated over the UNFILTERED task set), the makemd_query tool (passes unfiltered '...result' sibling fields through), and the list_templates tool (exposes template paths and parsed user-function bodies without a read-whitelist check). Limiting factors: the attacker must already be authenticated, the deployment must rely on a read ACL to segregate notes, and the disclosure is limited to path-attributable metadata, aggregate counts, and template bodies rather than arbitrary full-note contents - so impact is confidentiality-only inference/read of out-of-ACL notes, with no integrity or availability effect.

This is a genuinely low-priority information-disclosure issue, and the available signals are internally consistent. The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable but authenticated (PR:L) flaw with only low confidentiality impact and no integrity or availability impact - consistent with the description, which limits the attacker to inferring or reading data from notes outside their own read ACL rather than full vault compromise. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public exploit code was supplied; the only 'source code evidence' is the vendor's own remediation commit, which is a patch, not a weaponized POC. Crucially, the fix notes 'No change when no read whitelist is configured,' meaning the flaw is only exploitable in deployments that actually rely on a read ACL/whitelist to segregate notes - a conditional, trust-boundary leak rather than a broadly exploitable bug. Overall: real but minor, best treated as routine patch-on-next-cycle unless you depend on obsidian-tc's read ACL for multi-tenant or least-privilege note access.

In an obsidian-tc deployment that uses a read whitelist to restrict which notes a given agent/caller may read, an authenticated low-privilege caller invokes tasks_filter, makemd_query, or list_templates. Because those bridge tools return aggregate group counts, unfiltered sibling result fields, or template paths and parsed user-function bodies without applying the read whitelist, the caller infers or directly reads content from notes outside their ACL. No public exploit code is known; exploitation requires valid authenticated access and low complexity once a read whitelist is in use.