TI-2026-79945 CVE-2026-115477 · GHSA-737x-cwfr-5vvc
Declined confirmations in obsidian-tc permit destructive tool calls
Priority MEDIUM 64
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults.
The-40-Thieves
Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
The-40-Thieves records in CISA KEVNo The-40-Thieves vulnerabilities are listed in CISA KEV.
Records
7 records
TI-2026-71222 CVE-2026-77366 · GHSA-84c9-qqpq-2pq5
Authorization bypass in obsidian-tc lets tokens access other vaults
Priority MEDIUM 43
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults.
TI-2026-71220 CVE-2026-77363 · GHSA-pqh8-4pj7-32xx
Missing origin checks in obsidian-tc expose local vault to web pages
Priority LOW 39
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults.
TI-2026-79946 CVE-2026-115478 · GHSA-r3g7-r4hr-m258
Memory tools in obsidian-tc overwrite unowned notes on disk
Priority LOW 31
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults.
TI-2026-71221 CVE-2026-77364 · GHSA-cvp8-vvgf-69q4
Default ACL in obsidian-tc exposes Obsidian control-directory secrets
Priority LOW 28
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults.
TI-2026-71748 CVE-2026-77361 · GHSA-c5xx-h28h-f682
Symlink path mismatch in obsidian-tc bypasses read ACL restrictions
Priority LOW 20
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults.
TI-2026-71798 CVE-2026-77362 · GHSA-43r2-c7g8-prc8
Missing read ACL checks in obsidian-tc expose note data
Priority LOW 19
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults.