Skip to content
OpenAdvisories

Vendor

The-40-Thieves

7 known vulnerabilities.

Products

obsidian-tc 7
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.7
    CVE-2026-77361

    obsidian-tc symlink path mismatch bypasses read ACL restrictions

    obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list (ACL) checks use a lexical vault-relative path while containment checks use the resolved path. An in-vault symlink under an allo…

    The-40-Thieves obsidian-tc obsidian-tc npm
  • Medium 4.3
    CVE-2026-77362

    obsidian-tc bridge tools expose data outside the read ACL

    obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group counts derived fro…

    The-40-Thieves obsidian-tc obsidian-tc npm
  • Medium 6.5
    CVE-2026-77364

    obsidian-tc fail-open default ACL exposes Obsidian control-directory secrets

    obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash cont…

    The-40-Thieves obsidian-tc obsidian-tc npm