obsidian-tc EUVD-2026-98694

Exploitation requires three concrete prerequisites drawn from the advisory: (1) the obsidian-tc server must be configured with folder-level ACLs that have at least one allowed glob and at least one denied in-vault folder; (2) an attacker-controlled symlink must already exist inside the vault under an allowed glob and resolve into the denied folder - the description states this symlink is 'out-of-band-planted,' meaning the attacker needs a separate filesystem write channel since obsidian-tc itself does not create it; and (3) the caller must be an authenticated client (PR:L). Key LIMITING factors: the flaw cannot escape the vault root (strictly intra-vault), requires local access (AV:L) and high attack complexity (AC:H) due to the pre-planted-symlink precondition, has confidentiality-only impact (read/ACL-scope, no integrity or availability loss in the base case), and does not apply to deployments without symlinks or without a restrictive folder ACL.

This is a genuine-but-low-priority access-control weakness, and the signals align rather than conflict. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 4.7 Medium) describes a local, high-complexity, authenticated bug with confidentiality-only impact and no scope change - consistent with the description, which requires an out-of-band-planted in-vault symlink and explicitly does NOT allow escape from the vault root. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis'; this is a defense-in-depth ACL-scoping flaw rather than an actively exploited or wormable issue. The AC:H rating is well-justified because the attacker must already be able to plant a symlink inside the vault through some other channel and the deployment must use folder ACLs with distinct allowed/denied in-vault folders. The main caveat: the input Tags label this an 'Authentication Bypass,' but the vulnerability is actually an intra-vault read/write ACL-SCOPE bypass (the attacker is already authenticated at PR:L) - it does not bypass authentication, so that signal overstates the issue. Net: real and worth patching, but not a widespread-exploitation priority.

An authenticated low-privilege user of the obsidian-tc MCP server (or an AI agent acting through it) whose ACL denies a sensitive folder arranges, via an out-of-band channel, for a symlink to be placed under an allowed glob that points at the denied in-vault folder. They then invoke a read tool against the symlink path; because the ACL check uses the lexical allowed path while the filesystem follows the symlink, the denied folder's files are disclosed. No public exploit code is identified at time of analysis, and the attack stays within the vault root.