Skip to content
OpenAdvisories

Vendor

The-40-Thieves

7 known vulnerabilities.

Products

obsidian-tc 7
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.1
    CVE-2026-115478

    obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

    obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLite at the computed `me…

    The-40-Thieves obsidian-tc obsidian-tc npm
  • High 7.1
    CVE-2026-115477

    obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP

    obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` configured and a 2026-07-28-era client declaring `elicitation.form` support, a dispatch-g…

    The-40-Thieves obsidian-tc obsidian-tc npm
  • High 8.8
    CVE-2026-77363

    obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access

    obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration …

    The-40-Thieves obsidian-tc obsidian-tc npm