The report
Three Obsidian-TC MCP security advisories were originally published and patched in July 2026, but received renewed attention when their CVEs became visible in October. All identify 1.3.1 as the first published corrected version. They describe different authorization failures; neither the common product nor the indexing date makes them one attack chain.
One server, three distinct boundaries
| Vulnerability | Boundary missed | What the advisory reports |
|---|---|---|
| CVE-2026-77366 | Caller-to-vault identity | An authenticated tool request could supply another configured vault through input.vault instead of remaining bound to ctx.vaultId. About 90 tool sites lacked the check. |
| CVE-2026-77363 | Browser-to-local HTTP origin | Under documented unauthenticated loopback mode, absent origin and DNS-rebinding protection exposed an MCP transport to browser-mediated requests with broad local scope. |
| CVE-2026-77364 | Vault-file operation | Hidden .obsidian paths were absent from listings but still directly readable; the maintainer reproduced access to plugin secrets and Sync passwords. |
The first requires a credential in a multi-vault deployment. The second requires the vulnerable local HTTP configuration and browser/network conditions; loopback binding is not proof that arbitrary remote clients could directly connect. The third involves overbroad access inside a vault that the caller could already reach, not another tenant's vault. The maintainer advisories describe authorization rather than a measured production victim count.
A version fix is not a single regression test
The 1.3.1 repairs bind the requested vault to the caller, validate allowed hosts and origins, and enforce denials for sensitive file paths on the direct operation. Testing should mirror each distinction: try vault B with vault A's credential, send invalid HTTP origins in the vulnerable local mode, and request .obsidian secrets by exact pathname rather than relying on directory listings. A server passing one check says nothing about the other two.
The advisories document defects and corrections, not evidence of an October outbreak. Source records for origin handling and default file access remain independently linked for their separate prerequisites and effects.