Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115478— obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

Quick assessment

Affected
The-40-Thieves obsidian-tc
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

obsidian-tc 是一个专为 Obsidian 仓库设计的、受管且支持智能体的模型上下文协议（MCP）服务器。在 1.0.1 至 1.31.4 版本期间， 、 、 、 和 等操作会在计算出的 路径处，从 SQLite 数据库重新生成记忆笔记，但无法可靠地保留笔记的所有权，也无法保证在生命周期操作失败时数据的一致性。 在共享实体化（shared materialization）过程中，若存在由用户手动编写的笔记，或由其他实体遗留且其名称经清理后映射到相同路径的孤立笔记，则在下一次针对该类型和名称的写入操作中，这

CVSS 7.1 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
The-40-Thieves obsidian-tc >= 1.0.1, < 1.31.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115478

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
Source: CVE Program / CVE List V5
Vulnerability Description
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLite at the computed `memory/<type>/<name>.md` path without reliably preserving note ownership or the consistency of a failed lifecycle operation. During shared materialization, a hand-authored note or an orphan left by a different entity whose name sanitized to the same path could have its entire body overwritten on the next write naming that type and name, with non-owned frontmatter preserved. `rename_entity` also seeded the destination path with a direct atomic write without validating ownership and could overwrite a foreign note there. Separately, several tools mutated SQLite before fallible filesystem work: `create_entity` and `link_entities` inserted the row or relation before materialization; `rename_entity` updated the entity, including a retired status, before updating its note; `unlink_entities` removed a relation before rematerializing the source note; and `delete_entity`'s cascade removed the target and its relations before rematerializing neighbouring notes. A later filesystem failure could therefore leave a row or relation changed and the memory graph inconsistent with the notes on disk even when the operation failed. An authorized caller with the required memory-tool permissions could, without intending to, destroy the body of a vault note outside the entity being written; `delete_entity` additionally requires its deletion permission and destructive confirmation, which this memory flaw does not bypass. Snapshots-before-write through `restore_note` mitigate the overwrite only where snapshots are enabled and the note had previously been written through obsidian-tc. This issue is fixed in version 1.31.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
清理环节不完整
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
The-40-Thieves obsidian-tc >= 1.0.1, < 1.31.4 -

II. Public POCs for CVE-2026-115478

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115478

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-115478 (1)

Vendor Advisories for CVE-2026-115478 (1)

IV. Related Vulnerabilities

Same product: obsidian-tc
Same vendor: The-40-Thieves
Same weakness: CWE-459

V. Comments for CVE-2026-115478

No comments yet

Leave a comment