---
id: "CVE-2026-77366"
kind: "vulnerability"
aliases: ["CVE-2026-77366", "GHSA-84c9-qqpq-2pq5"]
title: "obsidian-tc tokens can access arbitrary configured vaults"
severity: "critical"
cvss: 9.9
epss: 0.0030799999367445707
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "obsidian-tc", "fixed": ["1.3.1"], "affected": "< 1.3.1", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["ai-tooling", "cwe-639", "cwe-863", "mcp", "multi-tenant", "node", "obsidian-tc"]
not_affected_if: ["single-tenant", "single-vault-per-process"]
published_at: "2026-10-12T18:17:23+00:00"
first_seen_at: "2026-10-23T19:11:31+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-84c9-qqpq-2pq5", "first_seen_at": "2026-10-23T19:11:31+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77366", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# obsidian-tc tokens can access arbitrary configured vaults

obsidian-tc is an MCP server for Obsidian vaults. Any valid token can read, write, or delete any configured vault by passing a different vault name in the request, which breaks tenant isolation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:obsidian-tc affected < 1.3.1 fixed 1.3.1

## How to check

Run npm ls obsidian-tc to find the installed version; anything below 1.3.1 is affected.
If the server is shared by several tenants with more than one configured vault, treat it as exposed.

## Fix

Upgrade obsidian-tc to 1.3.1 or later.
Until then, run one vault per server process, or give each tenant a separate process and credential.

## Timeline

- 2026-10-23T19:11:31+00:00 ghsa https://github.com/advisories/GHSA-84c9-qqpq-2pq5
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77366

## From the sources

### Impact
Tool dispatch did not check the caller-supplied `input.vault` against the caller's bound vault (`ctx.vaultId`); the folder ACL was a single global instance and the JWT carried no vault claim. As a result, **any valid token could read, write, or delete any configured vault** by passing `input.vault`, defeating multi-tenant isolation across ~90 tool sites. (`resources/read` was the only surface that already guarded this.)

### Patches
Fixed in **1.3.1** (the fix was developed on the `v1.3.0` tag, which never published to npm; 1.3.1 is the first published release with the fix). Upgrade to `>= 1.3.1`.

### Workarounds
Run a single vault per server process, or isolate each tenant on a separate process/credential.

### Fix
A central `input.vault === ctx.vaultId` guard was added in dispatch before the scope check.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_