CVE-2026-77364
Received Received - Intake

Authenticated File Read Vulnerability in Obsidian-TC Server

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only during enumeration. An authenticated caller can directly read sensitive files such as .obsidian/plugins/*/data.json, potentially exposing plugin API keys, Obsidian Sync passwords, and other in-vault data. Version 1.3.1 fixes the vulnerability by denying the control directories by default and enforcing strictReadDefault on direct request paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-77364
EUVD
EUVD-2026-97736

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
The-40-Thieves obsidian-tc < 1.3.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-276 During installation, installed file permissions are set to allow anyone to modify those files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects obsidian-tc, a Model Context Protocol server for Obsidian vaults. Prior to version 1.3.1, undefined readPaths and writePaths settings allowed all paths by default. The strictReadDefault setting failed to protect direct requests, and sensitive directories like .obsidian, .git, and .trash were only excluded during enumeration. An authenticated attacker could directly read sensitive files such as .obsidian/plugins/*/data.json, exposing plugin API keys and Obsidian Sync passwords.

Detection Guidance

Check if your obsidian-tc instance is running a version prior to 1.3.1. Inspect configuration files for undefined readPaths/writePaths settings and verify if strictReadDefault is properly enforced. Look for unauthorized access attempts to .obsidian, .git, or .trash directories.

Impact Analysis

If you use obsidian-tc versions prior to 1.3.1, an attacker with access could read sensitive files in your Obsidian vault. This includes plugin API keys and Obsidian Sync passwords stored in files like .obsidian/plugins/*/data.json. The impact is high on confidentiality as it allows unauthorized access to private data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive personal or health data stored in Obsidian vaults, violating GDPR and HIPAA compliance. Exposure of API keys or passwords may also result in further data breaches, increasing regulatory penalties and legal risks.

Mitigation Strategies

Upgrade obsidian-tc to version 1.3.1 or later. Explicitly configure readPaths and writePaths to exclude sensitive directories like .obsidian, .git, and .trash. Ensure strictReadDefault is set to true to enforce deny-by-default access control.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77364. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart