Evidence · DiggingBeagle record
Obsidian-TC cross-vault authorization advisory GHSA-84c9-qqpq-2pq5
Maintainer advisory for authenticated cross-vault access via input.vault, affected versions before 1.3.1, and central vault-binding fix.
- Published
- Jul 3, 2026
- Source role
- primary disclosure
Evidence record
Maintainer advisory for authenticated cross-vault access via input.vault, affected versions before 1.3.1, and central vault-binding fix.
Claim-level citations (2)
- supportsObsidian-TC tool calls crossed assigned vault boundaries with valid credentials: Before 1.3.1, valid Obsidian-TC tokens could use tool input.vault to read, write or delete another configured vault because input.vault was not bound to ctx.vaultId.
Impact; central input.vault versus ctx.vaultId description
- supportsObsidian-TC tool calls crossed assigned vault boundaries with valid credentials: The maintainer says approximately 90 tool sites were affected while resources/read already checked the vault, and 1.3.1 introduced a central equality guard.
Impact; Patches; Fix