---
id: "CVE-2026-77362"
kind: "vulnerability"
aliases: ["CVE-2026-77362", "GHSA-43r2-c7g8-prc8"]
title: "obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields"
severity: "medium"
cvss: 4.300000190734863
epss: 0.001990000018849969
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "obsidian-tc", "fixed": ["1.3.1"], "affected": "< 1.3.1", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["ai-tooling", "cwe-200", "cwe-863", "mcp", "npm", "obsidian", "obsidian-tc"]
not_affected_if: ["bridge-tools-disabled", "upgraded-to-1.3.1"]
published_at: "2026-10-13T14:17:42+00:00"
first_seen_at: "2026-10-23T19:11:31+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-43r2-c7g8-prc8", "first_seen_at": "2026-10-23T19:11:31+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77362", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

The obsidian-tc MCP Bridge tools filtered only the items array against the note read ACL and returned sibling fields unfiltered, so tasks_filter group counts, makemd_query result siblings, and list_templates output exposed data from denied notes. A caller can infer or read content from notes outside its read permissions.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:obsidian-tc affected < 1.3.1 fixed 1.3.1

## How to check

Run npm ls obsidian-tc in the project that loads the bridge and check whether the version is below 1.3.1.

## Fix

Upgrade obsidian-tc to 1.3.1 or later.
As a workaround, disable the tasks_filter, makemd_query and list_templates tools via tool visibility.

## Timeline

- 2026-10-23T19:11:31+00:00 ghsa https://github.com/advisories/GHSA-43r2-c7g8-prc8
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77362

## From the sources

### Impact
Bridge tool results filtered only the `items` array against the read ACL and passed sibling fields through unfiltered: `tasks_filter` emitted `groups` whose counts reflected denied notes, `makemd_query` returned `...result` siblings, and `list_templates` enumerated Templater template paths and parsed user-function bodies with no read-whitelist gate. A caller could infer or read data from notes outside its read ACL.

### Patches
Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. All path-attributable fields are now scrubbed or fail-closed, and `list_templates` is gated on the read whitelist.

### Workarounds
Disable the affected bridge tools (`tasks_filter`, `makemd_query`, `list_templates`) via tool visibility.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_