What happened
Published 2026-10-13 (CVSS 4.7, CWE-59/863) via GitHub advisory; ACL now applied to the resolved vault-relative path. Verified via NVD REST API.
Why it matters
MCP file-read ACLs are how agents are confined from sensitive notes; a symlink mismatch lets an agent read denied content, a precise but narrow bypass of the vault governance model.
Attack vector
Read ACL checks use a lexical vault-relative path while containment checks use the resolved path; an in-vault symlink under an allowed glob that resolves into a denied folder bypasses the read ACL.
Affected systems
obsidian-tc MCP server < 1.3.1
Mitigation
Upgrade obsidian-tc to 1.3.1 (GHSA-c5xx-h28h-f682).