CVE-2026-77366: obsidian-tc tokens can access arbitrary configured vaults

In affected versions, tool dispatch took input.vault from the request and never compared it with the caller's bound vault, ctx.vaultId. The folder ACL was a single global instance, and the JWT carried no vault claim. A caller with any valid token could name another vault in input.vault and act on it. The advisory counts about 90 tool call sites affected. Only resources/read already had the guard.

A token holder needs low privileges and no user interaction. They get read, write and delete over every vault the server has configured, including those that belong to other tenants. The CVSS vector scores that as a changed scope with high impact on confidentiality, integrity and availability.

This matters for anyone running one obsidian-tc server for several users or teams, each with their own vault and token. A single-vault server has nothing else to reach. The fix adds a central input.vault === ctx.vaultId guard in dispatch before the scope check.

Affected: npm package obsidian-tc before 1.3.1, on servers that configure more than one vault and issue tokens per vault. The fix was developed on the v1.3.0 tag, which never published to npm, so 1.3.1 is the first published release with it. Check:

npm ls obsidian-tc

Upgrade to obsidian-tc 1.3.1 or later.

npm install obsidian-tc@latest

The advisory's workaround: run a single vault per server process, or isolate each tenant on a separate process with its own credential. Treat the contents of other vaults as exposed if a token holder was not fully trusted.

Review the server's tool-call logs for requests where input.vault differs from the vault the token was issued for. Check each vault for notes created, edited or deleted by a caller you do not expect, and for files removed outside normal activity. Version control or backup history of the vault helps find unauthorized changes.

Impact

Tool dispatch did not check the caller-supplied input.vault against the caller's bound vault (ctx.vaultId); the folder ACL was a single global instance and the JWT carried no vault claim. As a result, any valid token could read, write, or delete any configured vault by passing input.vault, defeating multi-tenant isolation across ~90 tool sites. (resources/read was the only surface that already guarded this.)

Patches

Fixed in 1.3.1 (the fix was developed on the v1.3.0 tag, which never published to npm; 1.3.1 is the first published release with the fix). Upgrade to >= 1.3.1.

Workarounds

Run a single vault per server process, or isolate each tenant on a separate process/credential.

Fix

A central input.vault === ctx.vaultId guard was added in dispatch before the scope check.