Is CVE-2026-77362 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77362 being exploited in the wild.

How severe is CVE-2026-77362?

Medium severity, with a CVSS score of 4.3, published 13 October 2026.

Which products and versions are affected?

obsidian-tc (npm) < 1.3.1, SEMVER:introduced=0,fixed=1.3.1; The-40-Thieves Obsidian-Tc before 1.3.1.

How is CVE-2026-77362 attacked?

It is attacked over the network.

Am I affected by CVE-2026-77362?

Check whether you run obsidian-tc (npm) or The-40-Thieves Obsidian-Tc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77362: obsidian-tc information disclosure via bridge tools ACL bypass

Q: Which products and versions are affected?

obsidian-tc (npm) < 1.3.1, SEMVER:introduced=0,fixed=1.3.1; The-40-Thieves Obsidian-Tc before 1.3.1.

Q: Is there a fix for CVE-2026-77362?

Yes. obsidian-tc (npm): upgrade to 1.3.1 or later. Until then: Upgrade to obsidian-tc 1.3.1 or later. Until patched, restrict network access to the server and audit token distribution to minimize exposure window. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-77362 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-77362?

Check whether you run obsidian-tc (npm) or The-40-Thieves Obsidian-Tc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77362 · Severity: medium · CVSS 4.3 · Published 2026-10-13

obsidian-tc is a server that connects Obsidian note-taking vaults to AI agents via the Model Context Protocol. Prior to version 1.3.1, three bridge tools fail to properly enforce read access controls, allowing authenticated users to infer or read sensitive data from notes they should not have access to. This could expose confidential information stored in restricted notes.

Technologies: obsidian-tc (npm), The-40-Thieves Obsidian-Tc. Vendors: npm, The-40-Thieves.

Quick answers

Is CVE-2026-77362 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77362 being exploited in the wild.
How severe is CVE-2026-77362?: Medium severity, with a CVSS score of 4.3, published 13 October 2026.
Which products and versions are affected?: obsidian-tc (npm) < 1.3.1, SEMVER:introduced=0,fixed=1.3.1; The-40-Thieves Obsidian-Tc before 1.3.1.
Is there a fix for CVE-2026-77362?: Yes. obsidian-tc (npm): upgrade to 1.3.1 or later. Until then: Upgrade to obsidian-tc 1.3.1 or later. Until patched, restrict network access to the server and audit token distribution to minimize exposure window. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77362 attacked?: It is attacked over the network.
Am I affected by CVE-2026-77362?: Check whether you run obsidian-tc (npm) or The-40-Thieves Obsidian-Tc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

obsidian-tc (npm): upgrade to 1.3.1 or later
```
npm install obsidian-tc@1.3.1
```

Upgrade to obsidian-tc 1.3.1 or later. Until patched, restrict network access to the server and audit token distribution to minimize exposure window.

Technical details

The vulnerability is an access control bypass affecting three bridge tools (tasks_filter, makemd_query, list_templates) that filter results by read ACL but leak path-attributable fields and aggregate metadata. tasks_filter exposes group counts computed over the unfiltered note set; makemd_query spreads unfiltered result siblings; list_templates returns template paths and parsed function bodies without any ACL gate. An authenticated caller exploiting this gains visibility into notes outside their read whitelist.

Affected products

The-40-Thieves obsidian-tc before 1.3.1

Identifiers

CVE-2026-77362
GHSA-43r2-c7g8-prc8

Timeline

2026-07-01: patched: Security fix merged in commit 5ab2109
2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.