obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default

中 6.5CVE-2026-77364 · GHSA-cvp8-vvgf-69q4 · 12/10/2026 公開 · 16/10/2026 更新

要点

CVE-2026-77364 は obsidian-tc に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.24%（全脆弱性の 15.0% より高い）。
対処：1.3.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
obsidian-tc npm	`< 1.3.1`	`1.3.1`

概要

Impact

With a default configuration, an undefined readPaths/writePaths meant allow-all, the strictReadDefault flag was inert, and the .obsidian/.git/.trash control directories were denied only during enumeration — not on the direct request path. A caller could read .obsidian/plugins/*/data.json, exfiltrating plugin API keys and Obsidian Sync passwords (live-reproduced), as well as any other in-vault file by path.

Patches

Fixed in 1.3.1. Upgrade to >= 1.3.1. The default now denies .obsidian/.git/.trash on read/write/delete and honors strictReadDefault on the request path.

Workarounds

Set an explicit readPaths/writePaths whitelist that excludes the control directories.

NVD の説明

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only during enumeration. An authenticated caller can directly read sensitive files such as .obsidian/plugins/*/data.json, potentially exposing plugin API keys, Obsidian Sync passwords, and other in-vault data. Version 1.3.1 fixes the vulnerability by denying the control directories by default and enforcing strictReadDefault on direct request paths.

参考情報

The-40-Thieves/obsidian-tc security advisory · WEB
The-40-Thieves/obsidian-tc#73 · WEB
The-40-Thieves/obsidian-tc commit 74de320 · WEB
The-40-Thieves/obsidian-tc · PACKAGE
The-40-Thieves/obsidian-tc release v1.3.1 · WEB
nvd.nist.gov/vuln/detail/cve-2026-77364 · ADVISORY

obsidian-tc のその他の脆弱性

すべて見る →

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン

パッケージ

影響を受けるバージョン

修正済みバージョン

obsidian-tc

npm

< 1.3.1

1.3.1

概要