Obsidian-TC tool calls crossed assigned vault boundaries with valid credentials

The MCP server separated caller authentication and generic folder scope checks from the vault-specific authorization decision. A tool caller authenticated to one configured vault could supply another vault in input.vault. About 90 tool dispatch locations checked the global ACL but not the binding to ctx.vaultId, and the token held no vault claim that could repair the omission automatically. The advisories distinguish the tools surface from resources/read, which already guarded the vault.

The maintainer fixed the central dispatch path in the first npm-published 1.3.1 release on July 3. October CVE indexing is a visibility update to an already disclosed and patched vulnerability, not a newly discovered exploit or evidence of a campaign.

The authenticated token and its coarse scopes were not themselves forged. The requester supplied input.vault, which was allowed to select an unrelated configured vault because the tool layer did not bind it to ctx.vaultId. The already guarded resources/read interface is an important counterexample: the defect was concentrated in tool dispatch rather than every protocol entry point. Regression tests should exercise both approved and rejected vault identifiers through read, write and delete tools, then ensure the central equality check runs before general scope checks.