{"id":"CVE-2026-77362","kind":"vulnerability","aliases":["CVE-2026-77362","GHSA-43r2-c7g8-prc8"],"related":[],"title":"obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields","description":"### Impact\nBridge tool results filtered only the `items` array against the read ACL and passed sibling fields through unfiltered: `tasks_filter` emitted `groups` whose counts reflected denied notes, `makemd_query` returned `...result` siblings, and `list_templates` enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL.\n\n### Patches\nFixed in **1.3.1**. Upgrade to `>= 1.3.1`. All path-attributable fields are now scrubbed or fail-closed, and `list_templates` is gated on the read whitelist.\n\n### Workarounds\nDisable the affected bridge tools (`tasks_filter`, `makemd_query`, `list_templates`) via tool visibility.","summary":"The obsidian-tc MCP Bridge tools filtered only the items array against the note read ACL and returned sibling fields unfiltered, so tasks_filter group counts, makemd_query result siblings, and list_templates output exposed data from denied notes. A caller can infer or read content from notes outside its read permissions.","severity":"medium","cvss":4.300000190734863,"epss":0.001990000018849969,"exploited":false,"exploited_at":null,"products":[{"name":"obsidian-tc","fixed":["1.3.1"],"affected":"< 1.3.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-tooling","cwe-200","cwe-863","mcp","npm","obsidian","obsidian-tc"],"not_affected_if":["bridge-tools-disabled","upgraded-to-1.3.1"],"how_to_check":"Run npm ls obsidian-tc in the project that loads the bridge and check whether the version is below 1.3.1.","fix":"Upgrade obsidian-tc to 1.3.1 or later.\nAs a workaround, disable the tasks_filter, makemd_query and list_templates tools via tool visibility.","status":"open","published_at":"2026-10-13T14:17:42+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T20:55:14+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T20:55:14Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade obsidian-tc to 1.3.1 or later.\nAs a workaround, disable the tasks_filter, makemd_query and list_templates tools via tool visibility.","reach":"unknown","impact":"medium","summary":"The obsidian-tc MCP Bridge tools filtered only the items array against the note read ACL and returned sibling fields unfiltered, so tasks_filter group counts, makemd_query result siblings, and list_templates output exposed data from denied notes. A caller can infer or read content from notes outside its read permissions.","category":"ai-tooling","who_cares":["obsidian-tc","mcp","obsidian","npm"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Caller infers or reads contents of notes outside its ACL.","analyst_note":"","how_to_check":"Run npm ls obsidian-tc in the project that loads the bridge and check whether the version is below 1.3.1.\nunknown","needs_analyst":false,"not_affected_if":["upgraded-to-1.3.1","bridge-tools-disabled"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000899,"input_tokens":3051,"output_tokens":1187,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-200':33B '-2026':16A,24A '-77362':17A,25A '-863':35B '1.3.1':163C,166C '43r2':20A 'acl':58B,107C,159C 'affect':191C 'ai':30B 'ai-tool':29B 'array':53B,103C 'attribut':170C 'bodi':140C 'bridg':4A,47B,96C,192C 'c7g8':21A 'caller':83B,148C 'close':178C 'content':88B 'could':149C 'count':68B,119C 'cve':15A,23A 'cwe':32B,34B 'data':10A,78B,153C 'deni':8A,80B,121C 'denied-not':7A 'disabl':189C 'emit':116C 'enumer':131C 'expos':77B 'fail':177C 'fail-clos':176C 'field':14A,62B,111C,171C 'filter':49B,66B,99C,115C,195C 'fix':161C 'function':139C 'gate':146C,183C 'ghsa':19A 'ghsa-43r2-c7g8-prc8':18A 'group':67B,117C 'impact':95C 'infer':85B,150C 'item':52B,102C 'leak':6A 'list':74B,129C,180C,198C 'makemd':69B,123C,196C 'mcp':36B,46B 'note':9A,56B,81B,90B,122C,155C 'npm':37B 'obsidian':2A,27A,38B,40B,44B 'obsidian-tc':1A,26A,39B,43B 'output':76B 'outsid':91B,156C 'pars':136C 'pass':109C 'patch':160C 'path':134C,169C 'path-attribut':168C 'permiss':94B 'prc8':22A 'queri':70B,124C,197C 'read':57B,87B,93B,106C,144C,152C,158C,186C 'read-whitelist':143C 'reflect':120C 'result':71B,98C,126C 'return':60B,125C 'scrub':174C 'sibl':13A,61B,72B,110C,127C 'task':65B,114C,194C 'tc':3A,28A,41B,45B 'templat':75B,130C,132C,133C,181C,199C 'tool':5A,31B,48B,97C,193C,201C 'unfilt':12A,63B,113C 'upgrad':164C 'user':138C 'user-funct':137C 'via':11A,200C 'visibl':202C 'whitelist':145C,187C 'whose':118C 'workaround':188C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-13T14:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-43r2-c7g8-prc8","url":"https://github.com/advisories/GHSA-43r2-c7g8-prc8","severity":"medium","published_at":"2026-10-23T18:28:14+00:00","modified_at":"2026-10-23T18:28:14+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-77362","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77362","severity":null,"published_at":"2026-10-13T14:17:42+00:00","modified_at":"2026-10-16T16:00:33+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}