Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115477— obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP

Quick assessment

Affected
The-40-Thieves obsidian-tc
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

obsidian-tc 是一个受治理且支持智能体的 Model Context Protocol（MCP）服务器，专为 Obsidian 知识库设计。在从 1.13.0 到 1.31.4 的版本中，若部署采用可流式处理的 HTTP 模式，并配置了 ，同时客户端为 2026 年 7 月 28 日左右发布且声明支持 ，则会出现以下漏洞：当某个受调度门控（dispatch-gated）的工具调用提供 确认提示时，即使用户明确拒绝或取消该请求，或 elicitation（引导）响应被省略或格式错误，只要客户端在重新提交时原

CVSS 7.1 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
The-40-Thieves obsidian-tc >= 1.13.0, < 1.31.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115477

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
Source: CVE Program / CVE List V5
Vulnerability Description
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` configured and a 2026-07-28-era client declaring `elicitation.form` support, a dispatch-gated tool call offered an `inputRequired` confirmation could still complete after the human declined or cancelled, or the elicitation response was omitted or malformed, provided the client echoed the validly bound `requestState` on resubmission. The server trusted an authentic, call-bound state as proof of approval even though that state was minted before the `elicitation/create` leg was asked and proved only that the resubmission belonged to the same call. A client behaving incorrectly or under an attacker's control could therefore execute dispatch-gated destructive vault operations without the human's approval, while still requiring the caller's ordinary tool permissions. Only tools marked `destructive: true` or requiring a scope with a human-in-the-loop floor were reachable through this bypass. The sixteen handler-side conditionally gated tools, including `write_note` overwrite and `move_note`, did not read elicitation state on the modern wire and let neither approval nor decline through that path. Affected deployments using stdio or leaving `auth.jwtSecret` unset instead used the CLI `elicit_token` fallback and did not offer this `requestState` round trip. The fix does not prevent a malicious client from reporting a fabricated approval, because the server cannot verify that the client displayed the form or that a human saw it. This issue is fixed in version 1.31.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
The-40-Thieves obsidian-tc >= 1.13.0, < 1.31.4 -

II. Public POCs for CVE-2026-115477

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115477

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-115477 (1)

Vendor Advisories for CVE-2026-115477 (1)

Other References for CVE-2026-115477 (1)

IV. Related Vulnerabilities

Same product: obsidian-tc
Same vendor: The-40-Thieves
Same weakness: CWE-285

V. Comments for CVE-2026-115477

No comments yet

Leave a comment