# CVE-2026-77362: obsidian-tc information disclosure via bridge tools ACL bypass

Source: https://junglewise.ai/threats/cve-2026-77362-obsidian-tc-is-a-governed-agent-ready-model-context-protocol  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-77362 · Severity: medium · CVSS 4.3 · Published 2026-10-13

obsidian-tc is a server that connects Obsidian note-taking vaults to AI agents via the Model Context Protocol. Prior to version 1.3.1, three bridge tools fail to properly enforce read access controls, allowing authenticated users to infer or read sensitive data from notes they should not have access to. This could expose confidential information stored in restricted notes.

Technologies: [obsidian-tc (npm)](https://junglewise.ai/threats/technologies/npm-obsidian-tc), [The-40-Thieves Obsidian-Tc](https://junglewise.ai/threats/technologies/obsidian-tc). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [The-40-Thieves](https://junglewise.ai/threats/vendors/the-40-thieves).

## Quick answers

**Is CVE-2026-77362 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77362 being exploited in the wild.

**How severe is CVE-2026-77362?** Medium severity, with a CVSS score of 4.3, published 13 October 2026.

**Which products and versions are affected?** obsidian-tc (npm) < 1.3.1, SEMVER:introduced=0,fixed=1.3.1; The-40-Thieves Obsidian-Tc before 1.3.1.

**Is there a fix for CVE-2026-77362?** Yes. obsidian-tc (npm): upgrade to 1.3.1 or later. Until then: Upgrade to obsidian-tc 1.3.1 or later. Until patched, restrict network access to the server and audit token distribution to minimize exposure window. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77362 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-77362?** Check whether you run obsidian-tc (npm) or The-40-Thieves Obsidian-Tc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- obsidian-tc (npm): upgrade to 1.3.1 or later

  ```sh
  npm install obsidian-tc@1.3.1
  ```


Upgrade to obsidian-tc 1.3.1 or later. Until patched, restrict network access to the server and audit token distribution to minimize exposure window.

## Technical details

The vulnerability is an access control bypass affecting three bridge tools (tasks_filter, makemd_query, list_templates) that filter results by read ACL but leak path-attributable fields and aggregate metadata. tasks_filter exposes group counts computed over the unfiltered note set; makemd_query spreads unfiltered result siblings; list_templates returns template paths and parsed function bodies without any ACL gate. An authenticated caller exploiting this gains visibility into notes outside their read whitelist.

## Affected products

- The-40-Thieves obsidian-tc before 1.3.1

## Identifiers

- CVE-2026-77362
- GHSA-43r2-c7g8-prc8

## Timeline

- 2026-07-01: patched: Security fix merged in commit 5ab2109
- 2026-10-13: disclosed

## References

- [https://github.com/The-40-Thieves/obsidian-tc/commit/5ab2109274acf0070601fa71a62b14ddc9652309](https://github.com/The-40-Thieves/obsidian-tc/commit/5ab2109274acf0070601fa71a62b14ddc9652309)
- [https://github.com/The-40-Thieves/obsidian-tc/pull/75](https://github.com/The-40-Thieves/obsidian-tc/pull/75)

## Related threats

- [obsidian-tc entity operations data loss through unserialized SQLite writes](https://junglewise.ai/threats/cve-2026-115478-obsidian-tc-is-a-governed-agent-ready-model-context-protocol)
- [obsidian-tc improper authorization in dispatch-gated tool execution](https://junglewise.ai/threats/cve-2026-115477-obsidian-tc-is-a-governed-agent-ready-model-context-protocol)
- [obsidian-tc ACL bypass via symlink path resolution](https://junglewise.ai/threats/cve-2026-77361-obsidian-tc-is-a-governed-agent-ready-model-context-protocol)
- [obsidian-tc cross-vault authorization bypass](https://junglewise.ai/threats/cve-2026-77366-obsidian-tc-is-a-governed-agent-ready-model-context-protocol)
- [obsidian-tc path traversal via undefined ACL defaults](https://junglewise.ai/threats/cve-2026-77364-obsidian-tc-is-a-governed-agent-ready-model-context-protocol)