obsidian-tc vulnerabilities
CVEs whose affected-version data names the obsidian-tc package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
7 CVEsRSS
CVE-2026-115478High· 7.1obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLi…
CVE-2026-115477High· 7.1obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
CVE-2026-77362Medium· 4.3obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes gr…
CVE-2026-77361Medium· 4.7obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list (ACL) checks use a lexical vault-relative path while containment checks use the resolved path. An in-vault…
CVE-2026-77366Critical· 9.9obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT)…
CVE-2026-77364Medium· 6.5obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian,…
CVE-2026-77363High· 8.8obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented l…