{"id":"CVE-2026-77366","kind":"vulnerability","aliases":["CVE-2026-77366","GHSA-84c9-qqpq-2pq5"],"related":[],"title":"obsidian-tc tokens can access arbitrary configured vaults","description":"### Impact\nTool dispatch did not check the caller-supplied `input.vault` against the caller's bound vault (`ctx.vaultId`); the folder ACL was a single global instance and the JWT carried no vault claim. As a result, **any valid token could read, write, or delete any configured vault** by passing `input.vault`, defeating multi-tenant isolation across ~90 tool sites. (`resources/read` was the only surface that already guarded this.)\n\n### Patches\nFixed in **1.3.1** (the fix was developed on the `v1.3.0` tag, which never published to npm; 1.3.1 is the first published release with the fix). Upgrade to `>= 1.3.1`.\n\n### Workarounds\nRun a single vault per server process, or isolate each tenant on a separate process/credential.\n\n### Fix\nA central `input.vault === ctx.vaultId` guard was added in dispatch before the scope check.","summary":"obsidian-tc is an MCP server for Obsidian vaults. Any valid token can read, write, or delete any configured vault by passing a different vault name in the request, which breaks tenant isolation.","severity":"critical","cvss":9.9,"epss":0.0030799999367445707,"exploited":false,"exploited_at":null,"products":[{"name":"obsidian-tc","fixed":["1.3.1"],"affected":"< 1.3.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-tooling","cwe-639","cwe-863","mcp","multi-tenant","node","obsidian-tc"],"not_affected_if":["single-tenant","single-vault-per-process"],"how_to_check":"Run npm ls obsidian-tc to find the installed version; anything below 1.3.1 is affected.\nIf the server is shared by several tenants with more than one configured vault, treat it as exposed.","fix":"Upgrade obsidian-tc to 1.3.1 or later.\nUntil then, run one vault per server process, or give each tenant a separate process and credential.","status":"open","published_at":"2026-10-12T18:17:23+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T20:55:17+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T20:55:17Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade obsidian-tc to 1.3.1 or later.\nUntil then, run one vault per server process, or give each tenant a separate process and credential.","reach":"network","impact":"high","summary":"obsidian-tc is an MCP server for Obsidian vaults. Any valid token can read, write, or delete any configured vault by passing a different vault name in the request, which breaks tenant isolation.","category":"ai-tooling","who_cares":["mcp","obsidian-tc","node","multi-tenant"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker with any valid token reads, writes, or deletes every configured vault.","analyst_note":"","how_to_check":"Run npm ls obsidian-tc to find the installed version; anything below 1.3.1 is affected.\nIf the server is shared by several tenants with more than one configured vault, treat it as exposed.","needs_analyst":false,"not_affected_if":["single-vault-per-process","single-tenant"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000499,"input_tokens":3075,"output_tokens":383,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,19A '-639':28B '-77366':12A,20A '-863':30B '1.3.1':144C,158C,169C '2pq5':17A '84c9':15A '90':129C 'access':6A 'acl':93C 'across':128C 'add':193C 'ai':25B 'ai-tool':24B 'alreadi':138C 'arbitrari':7A 'bound':88C 'break':70B 'caller':81C,86C 'caller-suppli':80C 'carri':102C 'central':188C 'check':78C,199C 'claim':105C 'configur':8A,58B,118C 'could':112C 'ctx.vaultid':90C,190C 'cve':10A,18A 'cwe':27B,29B 'defeat':123C 'delet':56B,116C 'develop':148C 'differ':63B 'dispatch':75C,195C 'first':161C 'fix':142C,146C,166C,186C 'folder':92C 'ghsa':14A 'ghsa-84c9-qqpq-2pq5':13A 'global':97C 'guard':139C,191C 'impact':73C 'input.vault':83C,122C,189C 'instanc':98C 'isol':72B,127C,179C 'jwt':101C 'mcp':31B,44B 'multi':33B,125C 'multi-ten':32B,124C 'name':65B 'never':154C 'node':35B 'npm':157C 'obsidian':2A,22A,37B,40B,47B 'obsidian-tc':1A,21A,36B,39B 'pass':61B,121C 'patch':141C 'per':175C 'process':177C 'process/credential':185C 'publish':155C,162C 'qqpq':16A 'read':53B,113C 'releas':163C 'request':68B 'resources/read':132C 'result':108C 'run':171C 'scope':198C 'separ':184C 'server':45B,176C 'singl':96C,173C 'site':131C 'suppli':82C 'surfac':136C 'tag':152C 'tc':3A,23A,38B,41B 'tenant':34B,71B,126C,181C 'token':4A,51B,111C 'tool':26B,74C,130C 'upgrad':167C 'v1.3.0':151C 'valid':50B,110C 'vault':9A,48B,59B,64B,89C,104C,119C,174C 'workaround':170C 'write':54B,114C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-12T18:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-84c9-qqpq-2pq5","url":"https://github.com/advisories/GHSA-84c9-qqpq-2pq5","severity":"critical","published_at":"2026-10-23T17:29:17+00:00","modified_at":"2026-10-23T17:29:18+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-77366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77366","severity":null,"published_at":"2026-10-12T18:17:23+00:00","modified_at":"2026-10-16T16:00:33+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}