Obsidian Tc
Monthly
Improper authorization in obsidian-tc prior to 1.3.1 lets any holder of a valid JWT reach beyond its own vault and read, write, or delete the contents of every other configured vault on the same HTTP server. The flaw affects CWE-639-style trust in a caller-controlled key: tool dispatch never compares the caller-supplied input.vault value against the vault bound to the caller, the JWT carries no vault claim, and the folder ACL is a single global instance, so roughly 90 vault-scoped tools resolve an attacker-named vault id under that shared ACL. Exploitation requires the HTTP transport with more than one vault configured and a valid token (authenticated, PR:L); the trusted stdio transport is unaffected and single-vault deployments have no second vault to pivot to, but cross-tenant confidentiality, integrity, and availability are all fully compromised when those conditions hold - no public exploit code has been identified at time of analysis.
Cross-origin requests to the obsidian-tc Model Context Protocol HTTP transport let any web page a victim visits read from and write to the entire Obsidian vault, because releases before 1.3.1 performed no Host or Origin header validation and ran with DNS-rebinding protection disabled. The issue affects deployments that run the Streamable HTTP transport bound to loopback under the documented auth.mode 'none' configuration, where inbound requests receive full wildcard vault scopes; the attacker needs remote, unauthenticated reach via the browser (PR:N) but must convince the victim to load an attacker-controlled page while the server is running (UI:R), yielding high confidentiality and integrity impact (CVSS 8.8, CWE-346). No public exploit was identified at time of analysis, and exploitation does not apply to server-to-server MCP clients (which send no Origin header), to deployments that configure any authentication mode other than 'none', or to version 1.3.1 and later, where host, origin, and DNS-rebinding validation are enabled by default.
Read access-control bypass in obsidian-tc before version 1.3.1 allows an authenticated MCP client to read files inside a denied vault folder by following an in-vault symlink that sits under an allowed glob. The server's folder ACL is evaluated against the lexical (pre-resolution) request path while the filesystem resolves the symlink to its real target, so the two checks disagree and the denied content is served. Exploitation is constrained: the symlink must already exist in the vault (planted out-of-band, since obsidian-tc does not create it), the attacker needs local access and an authenticated session (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 4.7), and the flaw cannot escape the vault root - it is strictly an intra-vault ACL-scope bypass with confidentiality-only impact. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; version 1.3.1 canonicalizes ACL checks through symlink resolution to close it.
Information disclosure in obsidian-tc (versions prior to 1.3.1) allows an authenticated caller of the MCP server to infer or read note data that falls outside their configured read access-control list. The flaw affects deployments that rely on a read whitelist to segregate vault notes: tasks_filter returns group counts aggregated over the unfiltered task set, makemd_query passes unfiltered sibling result fields through, and list_templates exposes template paths and parsed user-function bodies without a read-whitelist check, so an authenticated caller with PR:L privileges can obtain path-attributable metadata, aggregate counts, and template content from notes they are not permitted to read. The impact is confidentiality-only (CVSS 3.1 base 4.3, C:L, no integrity or availability effect), and no public exploit identified at time of analysis; the vendor released version 1.3.1 to correct the behavior.
obsidian-tc versions prior to 1.3.1 fail to enforce folder access controls on direct file requests, allowing an authenticated MCP caller to read vault control-directory files such as .obsidian/plugins/*/data.json, which routinely store plugin API keys and Obsidian Sync passwords. Because an undefined readPaths/writePaths whitelist defaults to allow-all (a deliberate M0 back-compatibility behavior) and the strictReadDefault guard was silently stripped by config validation and never applied to direct request paths, even operators who believed they had locked the server down received no protection; .obsidian, .git, and .trash were filtered only during enumeration. The issue is a moderate-priority confidentiality-only flaw (CWE-200, CVSS 6.5, PR:L) with no integrity or availability impact and no public exploit identified at time of analysis; the vendor-released fix in v1.3.1 adds a hard default-deny baseline for control directories plus schema and request-path enforcement of strictReadDefault.
Improper authorization in obsidian-tc prior to 1.3.1 lets any holder of a valid JWT reach beyond its own vault and read, write, or delete the contents of every other configured vault on the same HTTP server. The flaw affects CWE-639-style trust in a caller-controlled key: tool dispatch never compares the caller-supplied input.vault value against the vault bound to the caller, the JWT carries no vault claim, and the folder ACL is a single global instance, so roughly 90 vault-scoped tools resolve an attacker-named vault id under that shared ACL. Exploitation requires the HTTP transport with more than one vault configured and a valid token (authenticated, PR:L); the trusted stdio transport is unaffected and single-vault deployments have no second vault to pivot to, but cross-tenant confidentiality, integrity, and availability are all fully compromised when those conditions hold - no public exploit code has been identified at time of analysis.
Cross-origin requests to the obsidian-tc Model Context Protocol HTTP transport let any web page a victim visits read from and write to the entire Obsidian vault, because releases before 1.3.1 performed no Host or Origin header validation and ran with DNS-rebinding protection disabled. The issue affects deployments that run the Streamable HTTP transport bound to loopback under the documented auth.mode 'none' configuration, where inbound requests receive full wildcard vault scopes; the attacker needs remote, unauthenticated reach via the browser (PR:N) but must convince the victim to load an attacker-controlled page while the server is running (UI:R), yielding high confidentiality and integrity impact (CVSS 8.8, CWE-346). No public exploit was identified at time of analysis, and exploitation does not apply to server-to-server MCP clients (which send no Origin header), to deployments that configure any authentication mode other than 'none', or to version 1.3.1 and later, where host, origin, and DNS-rebinding validation are enabled by default.
Read access-control bypass in obsidian-tc before version 1.3.1 allows an authenticated MCP client to read files inside a denied vault folder by following an in-vault symlink that sits under an allowed glob. The server's folder ACL is evaluated against the lexical (pre-resolution) request path while the filesystem resolves the symlink to its real target, so the two checks disagree and the denied content is served. Exploitation is constrained: the symlink must already exist in the vault (planted out-of-band, since obsidian-tc does not create it), the attacker needs local access and an authenticated session (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 4.7), and the flaw cannot escape the vault root - it is strictly an intra-vault ACL-scope bypass with confidentiality-only impact. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; version 1.3.1 canonicalizes ACL checks through symlink resolution to close it.
Information disclosure in obsidian-tc (versions prior to 1.3.1) allows an authenticated caller of the MCP server to infer or read note data that falls outside their configured read access-control list. The flaw affects deployments that rely on a read whitelist to segregate vault notes: tasks_filter returns group counts aggregated over the unfiltered task set, makemd_query passes unfiltered sibling result fields through, and list_templates exposes template paths and parsed user-function bodies without a read-whitelist check, so an authenticated caller with PR:L privileges can obtain path-attributable metadata, aggregate counts, and template content from notes they are not permitted to read. The impact is confidentiality-only (CVSS 3.1 base 4.3, C:L, no integrity or availability effect), and no public exploit identified at time of analysis; the vendor released version 1.3.1 to correct the behavior.
obsidian-tc versions prior to 1.3.1 fail to enforce folder access controls on direct file requests, allowing an authenticated MCP caller to read vault control-directory files such as .obsidian/plugins/*/data.json, which routinely store plugin API keys and Obsidian Sync passwords. Because an undefined readPaths/writePaths whitelist defaults to allow-all (a deliberate M0 back-compatibility behavior) and the strictReadDefault guard was silently stripped by config validation and never applied to direct request paths, even operators who believed they had locked the server down received no protection; .obsidian, .git, and .trash were filtered only during enumeration. The issue is a moderate-priority confidentiality-only flaw (CWE-200, CVSS 6.5, PR:L) with no integrity or availability impact and no public exploit identified at time of analysis; the vendor-released fix in v1.3.1 adds a hard default-deny baseline for control directories plus schema and request-path enforcement of strictReadDefault.