Live › vulnerability › CVE-2026-77362
Go to dashboardThe obsidian-tc MCP Bridge tools filtered only the items array against the note read ACL and returned sibling fields unfiltered, so tasks_filter group counts, makemd_query result siblings, and list_templates output exposed data from denied notes. A caller can infer or read content from notes outside its read permissions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| obsidian-tc | npm | < 1.3.1 | 1.3.1 |
Run npm ls obsidian-tc in the project that loads the bridge and check whether the version is below 1.3.1.
1.3.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Bridge tool results filtered only the items array against the read ACL and passed sibling fields through unfiltered: tasks_filter emitted groups whose counts reflected denied notes, makemd_query returned ...result siblings, and list_templates enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL.
Fixed in 1.3.1. Upgrade to >= 1.3.1. All path-attributable fields are now scrubbed or fail-closed, and list_templates is gated on the read whitelist.
Disable the affected bridge tools (tasks_filter, makemd_query, list_templates) via tool visibility.
This page as .md · .json · in your agent: get_signal("CVE-2026-77362")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.