Obsidian-TC Critical Flaw Allows Cross-Vault Data Theft Before 1.3.1
A critical authorization bypass in obsidian-tc versions prior to 1.3.1 lets attackers access any vault with a single valid token.
Key points
- CVE-2026-77366 is rated CVSS 9.9 Critical by NVD
- The flaw allows reading, writing, or deleting contents of any configured vault
- Version 1.3.1 fixes the issue by binding tokens to specific vaults
The-40-Thieves released version 1.3.1 of obsidian-tc to address a critical authorization bypass vulnerability identified as CVE-2026-77366. This flaw allows attackers to access, modify, or delete data in any vault configured within the system using a single valid token.
At a glance
- CVE
- CVE-2026-77366
- Product
- The-40-Thieves obsidian-tc
- CVSS
- 9.9 Critical
- Weakness
- insecure direct object reference
- Exploited
- No known exploitation
The National Vulnerability Database rates the severity of CVE-2026-77366 as 9.9 Critical. The weakness stems from improper access control mechanisms that fail to verify the relationship between the caller and the target vault. According to the NVD record, the flaw involves CWE-639 and CWE-863 weaknesses in the software architecture.
Authorization Bypass Mechanism
In versions of obsidian-tc prior to 1.3.1, the tool dispatch process does not compare the caller-controlled input.vault value with the vault actually bound to the caller. This lack of verification creates a significant security gap in how the server handles requests.
The JSON Web Token used for authentication lacks a specific vault claim, meaning it does not restrict access to a single designated vault. Furthermore, the folder access-control list is shared globally across all configured vaults. This global sharing allows any valid token to select another configured vault and perform actions on it.
Impact and Remediation
Any attacker possessing a valid token can exploit this vulnerability to read, write, or delete contents through affected tools. The scope of the compromise extends to any vault configured within the obsidian-tc environment, not just the one the token was intended for.
Version 1.3.1 fixes the vulnerability by binding tokens and request context to a specific vault. The update also rejects mismatched input.vault values before performing scope checks, effectively preventing unauthorized cross-vault access. Users running versions earlier than 1.3.1 remain exposed to this critical risk.
Who is affected
The vulnerability affects obsidian-tc, described in the NVD record as a governed, agent-ready Model Context Protocol server for Obsidian vaults. The software is developed by The-40-Thieves.
Any deployment of obsidian-tc versions prior to 1.3.1 is vulnerable to this authorization bypass. Organizations or individuals using this server to manage Obsidian vaults must ensure they are not running the affected versions.
What should you do?
Administrators should immediately check their current version of obsidian-tc. If the version is earlier than 1.3.1, they should upgrade to the patched version to mitigate the risk.
Until an update is applied, users should restrict network access to the obsidian-tc server. Limiting exposure reduces the chance that an attacker can obtain a valid token and exploit the flaw.
What to do and how to stay safe: obsidian-tc
- Verify your obsidian-tc version and update to 1.3.1 or later immediately
- Restrict network access to the server to limit potential attackers
- Monitor logs for unauthorized access attempts or unusual vault selections
- Review token permissions to ensure least privilege access is enforced
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-77366?
It is a critical authorization bypass vulnerability in obsidian-tc versions prior to 1.3.1 that allows cross-vault data access.
How severe is this vulnerability?
The National Vulnerability Database rates it as 9.9 Critical.
Does the fix require a new version?
Yes, version 1.3.1 fixes the vulnerability by binding tokens to specific vaults and rejecting mismatched inputs.
