CVE-2026-77364

MediumCVSS 6.5/10Last modified Oct 16, 2026

Description

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only during enumeration. An authenticated caller can directly read sensitive files such as .obsidian/plugins/*/data.json, potentially exposing plugin API keys, Obsidian Sync passwords, and other in-vault data. Version 1.3.1 fixes the vulnerability by denying the control directories by default and enforcing strictReadDefault on direct request paths.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-276

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 12, 2026
Last modified: Oct 16, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-773657.2The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cro CVE-2026-773669.9obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the CVE-2026-773687.6SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowed_CVE-2026-77377.5A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisti CVE-2026-773719.3Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_CVE-2026-773756.5SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol messa CVE-2026-77386.3A security flaw has been discovered in puchunjie doc-tools-mcp 1.0.18. This affects the function create_document/open_document of the file s CVE-2026-773847.5libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-st CVE-2026-773854.3Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission cou CVE-2026-773866.5Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC CVE-2026-773874.0geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU time due to inefficient CVE-2026-77393.3A weakness has been identified in justdan96 tsMuxer up to 2.7.0. This vulnerability affects the function HevcVpsUnit::setFPS of the file /AF