CVE-2026-77364

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only during enumeration. An authenticated caller can directly read sensitive files such as .obsidian/plugins/*/data.json, potentially exposing plugin API keys, Obsidian Sync passwords, and other in-vault data. Version 1.3.1 fixes the vulnerability by denying the control directories by default and enforcing strictReadDefault on direct request paths.

• CWE-200
• CWE-276

• https://github.com/The-40-Thieves/obsidian-tc/commit/74de320ddea855e1dec47d67beabe88491149dab
• https://github.com/The-40-Thieves/obsidian-tc/pull/73
• https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1
• https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-cvp8-vvgf-69q4

Published

Oct 12, 2026

Last Modified

Oct 12, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77358cpp-httplib is a C++ header-only HTTP/HTTPS library. In vers…8.2
• CVE-2026-7736A vulnerability was determined in osrg GoBGP up to 4.3.0. Af…7.5
• CVE-2026-77360oRPC is an tool that helps build APIs that are end-to-end ty…6.3
• CVE-2026-77361obsidian-tc is a governed, agent-ready Model Context Protoco…4.7
• CVE-2026-77362obsidian-tc is a governed, agent-ready Model Context Protoco…4.3
• CVE-2026-77363obsidian-tc is a governed, agent-ready Model Context Protoco…8.8
• CVE-2026-77365The Optimole – Optimize Images | Convert WebP & AVIF | CDN &…7.2
• CVE-2026-77366obsidian-tc is a governed, agent-ready Model Context Protoco…9.9
• CVE-2026-77368SeaweedFS is a distributed storage system for files and blob…7.6
• CVE-2026-7737A vulnerability was identified in osrg GoBGP up to 4.3.0. Af…7.5
• CVE-2026-77375SFTPGo is an open source, event-driven file transfer solutio…6.5
• CVE-2026-7738A security flaw has been discovered in puchunjie doc-tools-m…6.3