CVE-2026-77361
Received Received - Intake

ACL Bypass via Symlink in Obsidian-TC

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list (ACL) checks use a lexical vault-relative path while containment checks use the resolved path. An in-vault symlink under an allowed glob that resolves into a denied folder can therefore bypass the read ACL and expose files in the denied folder. Exploitation requires an out-of-band-planted symlink and does not permit an escape from the vault root. Version 1.3.1 fixes the vulnerability by applying ACL checks to the resolved vault-relative path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-77361
EUVD
EUVD-2026-98694

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
The-40-Thieves obsidian-tc < 1.3.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in obsidian-tc (versions prior to 1.3.1) involves a flaw in Access Control List (ACL) checks where read permissions were verified using the lexical (textual) vault-relative path instead of the resolved (symlink-resolved) path. An attacker could plant a symlink in an allowed folder that points to a restricted folder. The ACL check would pass because it only examined the symlink's location, but the resolved path would grant access to the restricted files. The fix ensures ACL checks use the resolved path after following symlinks.

Exploitation requires an attacker to place a symlink in the vault beforehand. The symlink must be under an allowed glob pattern but resolve to a denied folder. The attack does not allow escaping the vault root and requires out-of-band symlink planting.

Detection Guidance

To detect this vulnerability, inspect your obsidian-tc installation for version prior to 1.3.1. Check for unexpected symlinks in vault directories that point to restricted folders. Use commands like 'find /path/to/vault -type l -ls' to list symlinks and 'ls -l' to verify their targets. Ensure ACLs are enforced on resolved paths, not just lexical paths.

Impact Analysis

If you use obsidian-tc versions prior to 1.3.1, an attacker with access to place a symlink in your vault could bypass read ACL restrictions. This could expose sensitive files in restricted folders that should not be accessible. The attacker needs to plant the symlink beforehand, so it requires some level of access to your system or vault. The confidentiality impact is high, meaning sensitive data could be leaked.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). If restricted files containing personal or health data are exposed due to the ACL bypass, organizations could face regulatory penalties, fines, or reputational damage. Ensuring proper ACL enforcement is critical for maintaining compliance.

Mitigation Strategies

Upgrade obsidian-tc to version 1.3.1 or later immediately. Review and tighten ACLs for sensitive directories like .obsidian, .git, and .trash. Remove any untrusted symlinks in the vault. Ensure ACL checks use resolved paths, not lexical paths, to prevent symlink-based bypasses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77361. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart