CVE-2026-115477

Name of the Vulnerable Software and Affected Versions obsidian-tc versions 1.13.0 through 1.31.3

Description On Streamable HTTP deployments with auth.jwtSecret configured, a flaw exists where dispatch-gated tool calls (those marked destructive: true or requiring a human-in-the-loop floor) can be executed without actual human approval. If a client declares elicitation.form support, the server may trust a validly bound requestState as proof of approval during resubmission, even if the human declined, cancelled, or provided a malformed response. This occurs because the requestState is minted before the elicitation request, proving only that the resubmission belongs to the same call rather than confirming approval. An attacker or a malfunctioning client could exploit this to perform destructive vault operations, such as deleting notes, cross-folder moves, frontmatter replacement, or link rewriting, provided they have ordinary tool permissions.

Recommendations Update obsidian-tc to version 1.31.4. As a temporary workaround, run deployments over stdio or leave auth.jwtSecret unset to force the use of the CLI elicit token path and disable the requestState codec.