CVE-2026-115477
Summary
by MITRE • 10/23/2026
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` configured and a 2026-07-28-era client declaring `elicitation.form` support, a dispatch-gated tool call offered an `inputRequired` confirmation could still complete after the human declined or cancelled, or the elicitation response was omitted or malformed, provided the client echoed the validly bound `requestState` on resubmission. The server trusted an authentic, call-bound state as proof of approval even though that state was minted before the `elicitation/create` leg was asked and proved only that the resubmission belonged to the same call. A client behaving incorrectly or under an attacker's control could therefore execute dispatch-gated destructive vault operations without the human's approval, while still requiring the caller's ordinary tool permissions. Only tools marked `destructive: true` or requiring a scope with a human-in-the-loop floor were reachable through this bypass. The sixteen handler-side conditionally gated tools, including `write_note` overwrite and `move_note`, did not read elicitation state on the modern wire and let neither approval nor decline through that path. Affected deployments using stdio or leaving `auth.jwtSecret` unset instead used the CLI `elicit_token` fallback and did not offer this `requestState` round trip. The fix does not prevent a malicious client from reporting a fabricated approval, because the server cannot verify that the client displayed the form or that a human saw it. This issue is fixed in version 1.31.4.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
Xxx Xxxxxxxxxxxxx Xxxxxxxxxx Xx Xxxxxxxx-xx Xxxxxxxx Xxxxxxx Xxxx X.xx.x Xx X.xx.x Xxxxxxxxxx X Xxxxxxxx Xxxxx Xxxx Xxxxxx Xxx Xxxxxxxxxxxxxx Xxx Xxxxxxxxxxxxx Xxxxxxxx Xx Xxxx Xxxxx Xxxxxxx Xxxxxxxx Xxxxxx Xxx Xxxxxxxx Xxxxxx. Xxx Xxxx Xxxxx Xxxxx Xxxx Xx Xxxxxxxxx Xxxxx Xxxxx Xxxxxxxxx Xxxxx Xxxxxxxxxx Xxxxxx Xxxxx-xx-xxx-xxxx Xxxxxxxxxxx Xxxxxxxxx. Xxxxxxxxxxxx, Xxxx Xxxxxxxxx Xx X Xxxxxxxxxx Xxxx Xxxxxxxxxx Xxxx Xxx Xxxxxx Xxxxxxxxxxxxx Xxxxxxx, Xxx Xxxxxx Xxxxxx Xx X Xxxxxxxxxxxx Xxxxx Xx Xxxxxxxx Xxxx Xxxxx Xxxx Xxxxxxx Xxxx Xxxxxxxxxxxx. Xxxxxxx, Xxx Xxxxxxxxxxxxxx Xxxxxxxxxxx Xxxxxx Xxxx Xxxxxxxxxxxx Xx Xxxxxxxxxx Xxxxx Xx Xxxxxxxx Xxxxx Xxxxxxxx Xxx Xxxxxxxxxxx Xxxxxxx. Xx Xxxxxxx, Xxx Xxxxxxxxxxxx Xx Xxxxxxxxx Xx Xxx Xxxxxxxxxx Xx Xxx Xxxx Xxx Xxxxxx Xxxxx Xxxxxxxxxx Xxxxxxxx Xx Xxxx Xxxxxxxx Xxxxxxxxxx Xxxxxxx. Xx Xxxx Xxx Xxxxx Xxx Xxxxxxxxxxx Xxxxx Xxxxxxx Xxx Xxxx Xxxxxxxx Xxxxxxxx Xx Xxxxxxxxx Xx Xxx Xxxxxx Xxx Xxx Xxxxxxxxxxx Xxxx Xxxxxxxxx Xx Xxx Xxxxxx Xxxxxxxxxxx.
Xxxx Xxxxxxxxxxxxx Xxxxxxxx Xxxxxx X Xxxxxxxxx Xx Xxxxxxxxxxx Xxxxxx Xx Xxxxxx Xxxxx-xx-xxx-xxxx Xxxxxxxxxx Xxxxxxxx. Xx Xxxxxx Xxxxxxx Xxxx Xxx Xxxxxxx Xxxxx Xxxxxxxxxxxx Xxxx Xx Xxxxxxx Xxxx Xxxxx Xxx Xxxx Xxxxxxxx, Xxxxxxxxx, Xx Xxxxxxx Xxx Xxxxxxxx, Xxx Xxxxxx Xxxxxxx Xxx Xxxxxxxxxxxx Xx Xxxxxxxxxx. Xxx Xxxxx Xxxx Xxxx Xx Xxx Xxxx Xxxx Xxx Xxxxxx Xxxx Xxx Xxxx Xxx Xxxxxxxxxxx Xxxxx Xx Xxx Xxxxxx Xxxx Xxxxxxxx Xxx Xxxxx Xxxxxxxx-xxxxx Xxxxx. Xxxxxxxxxxxx, Xxxxxxx Xxxxxxxx Xxx Xxxxxxx Xxxxxxx Xxx Xxxxxxxx Xxxxxxxxx Xxxxxxx Xxxx Xxxx. Xxxx Xxxxx Xxxx Xx Xxxxxxxx Xxxxxxxxxxx X Xxxxxx Xxx Xxxxxxx Xxxxxxxxxxx Xxxxx Xxxxxxxxxx Xxxxxxx Xxxx Xxxxxxxxx Xxxxxxx Xxxxx Xxxxxxx, Xxxxxxxx Xxxx Xxxxxxx Xxx Xxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx Xxxx Xxxxx Xxxx Xx Xxx Xxx.
Xxx Xxxxxxxxxxx Xxxxxx Xx Xxxx Xxxxxxxxxxxxx Xx Xxxxxx Xxx Xxxxxxxxxxx Xxxxxxxxx Xxxxxxxx Xxxxxxxxxxxxxx. Xx Xxxxxxx Xxxx Xxxxxxx Xxxxxxx-xxxx Xxxxx Xxxxxx Xx Xxxxxxxxxxx Xx Xxxxxxxxx X Xxxxx Xxxx X Xxxxx-xx-xxx-xxxx Xxxxx, Xxxx Xx Xxxxx_xxxx Xxxxxxxxx Xxx Xxxx_xxxx Xxxxxxxxxx. Xxxxx Xxxxxxx Xxx Xxxxx Xx Xxxxxx Xxxxxxxx Xxxx Xxxxxx Xxx Xxxxxxxx Xxxxx Xxxxxxx Xxxx Xxxxxxxxxxxx. Xxx Xxxxxx Xxxxxx Xxxxxxxx Xxx Xxxxxx Xx Xxxxxxx Xxxxxxx Xxx Xxxxxxxxxxx.xxxx Xx Xxx Xxxxxxxxxxxx Xxxxxx Xxx Xxxx-xx-xx Xxx Xxxxxxxxxxxxx Xxxxxx. Xxxxxxxxxxx Xxxxx Xxxxx Xxxxxxxxx Xx Xxxxx Xxxx Xxxxx Xxxx.xxxxxxxxx Xxxxx Xxx Xxx Xxxxxxxx, Xx Xxxx Xxxx Xx X Xxxxxxxxx Xxx-xxxxx Xxxxxx_xxxxx Xxxxxxxx Xxxxxxxxx Xxxxx Xxxx Xxx Xxxxxx Xxxx Xxxxxxxx Xxxxxxxxxxxx Xxxxx-xxxx Xxxxxxxxxxxxx. Xxxx Xxxxxxxxxxx Xxxxxxxxxx Xxx Xxxxxxxx Xxxxxxxx Xxx Xxxx Xxxxxxxxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxx Xxx Xxxxxxxxxxxxx Xxxxxxxxxx Xxxxxx Xxx Xxxx Xxxxxxxx Xxxxxxxxx.
Xxxx X Xxxxxxxxxxxxxx Xxxxxxxxxxx, Xxxx Xxxx Xxxxxx Xxxx Xxx-xxx Xxxxxxxx Xxxxxxxxxxxxxx Xxxxxxx Xxx Xxxxxx Xxxxx Xx Xxxxxxxxx Xxxxxx Xxxxxxxx Xx Xxxxxxxxxxxxx Xxxxxxxxxxx Xxx Xxxxxxxxxxxxxx Xxxxxxxxx. Xx Xxxx Xxxx Xxxxxxx Xx Xxx-xxx Xxxxxxxxxx Xxxxxxxxx Xxxxxxx Xxxxx Xxx Xxxxxxxx Xxxxxxx Xxxxxxxx Xx Xxxxxxx Xxxxxxxxxxxx Xxxxxxx Xx Xxxxxxxx Xxxxxxx Xxxxxxx Xxxxxxxxxxxx Xx Xxxxx Xxxxxx. Xx Xxxxx Xx Xxxxx Xxx&xx, Xxxx Xxxxxxxx Xxxxxxxxxxx Xxxxxxx Xxxxxxxx Xxx Xxxxxxxxx Xxxxxxxxxx Xxxxxx Xxx Xxxxxxx Xx Xxxxx Xxxx Xxxxxx Xxxxxx, Xxxxxxxxxxx Xxxxxxxxxxx Xxxxx Xxxxx Xxxxxxx Xxx Xxxxxxxxx Xxxxxxxxxxx Xx Xxxx Xx Xxxxxxxxxxx Xxxx Xxxxx Xxxxxxxx, Xx Xxxx Xxxxxxxxxx Xx X Xxxxxxxxx Xx Xxxxxxxx Xxxxxxxx Xxxxxxxxxxxx Xxxx Xxxxx Xxxx Xx Xxxx Xxxxxxxxxxxx Xx Xxxxxxxxxxx. Xxx Xxxxxxxxx Xx Xxx Xxxxxx Xx Xxxxxx Xxxxxxx Xxx Xxxxxx Xxxxxxxx Xxxxxxxxx Xxx Xxxx Xxxxx Xx Xxxxxx Xxxxxxxxxxx Xxxxxxx X Xxxxxxxxxx Xxxx Xxxxxxxxxxx Xxx Xx Xxxxxxxxx Xxxxxx Xxxxxxxxx Xxxxx Xxxxxx.
Xxxxxxxxxx Xxxxxxxxxx Xxxx Xxxxx Xx Xxxxxxxxx Xxxxxxx Xxxxxxxx Xxx Xxxxxxxxxxxxx Xxxxxxx. Xxxxxxxxxxxxx Xxxxxxx Xxxxxxxx Xxxxxxxx Xxxxxx Xxxxxxx Xx X.xx.x Xxxxxxxxxxx, Xx Xxxx Xxxxxxx Xxxxxxxx Xxx Xxxxx Xxxxxxxxxx Xxxxx Xx Xxxxxx Xxxx Xxxxx Xxxxxxxx Xx Xxxxxxxxx Xxxxxxxx Xxxxxx Xxxxxxxxx Xxxxxxxxxxx Xxxxxxxx. Xxx Xxxxxxxxxxxx Xxxxx Xxxxxxxxx Xx Xxx Xxxxxxxxxxx Xxxxxxxx, Xxxxxxxxxxxxxx Xxx Xxxxxxxx Xxxx Xx Xxxxxxxxx Xxxxxxxxxx Xxxx Xxxxxxxxxxx Xx Xxxxxxxx Xxxx.xxxxxxxxx Xxxxxxx Xxxxx Xx Xxxxxxxx, Xxxxxxx Xxxxxxx Xxxxxxxx Xx Xxx Xxxxx Xxx-xxxxx Xxxxxxxxxxx Xxxxx Xxxxxxxxx. Xxxxxxxxxxxx, Xxxxxxxxxxxx Xxxxxx Xxxxx Xxxxxxxxxx Xxx Xxxxxxxxxx Xxx Xxxxxxxxx Xxxxxxxx Xx Xxxx Xxxxx Xxxx Xxxxx Xxxxxxx Xxxxx X Xxxxxxxx Xxxxxxxxxxx Xxxxx Xxx Xxxx Xxxxxx Xxxxxxxxxxxx Xxxxxxxx Xx Xxxx-xxxx. Xxxx-xxxx Xxxxxxxxxxx Xxxxxx Xxxxxxx Xxxxxxxxxxx Xxx Xxxxxxxxxxxxxx Xxxx Xx Xxxxxxxx Xxxxxxx Xxxxxxx Xxxx Xxxxxxxx Xxxxxxxxxxxx, Xxxxxxxx Xxxx Xxxxxxxx Xxxxxx Xx Xxxxxx Xxx Xxxx Xx Xxxxx Xxxx Xxxxxxx Xxxxxxxxxxxxx Xx Xxxx Xxxxxxxxxxxxxx.