What happened
Two obsidian-tc issues were fixed in 1.31.4: a human-in-the-loop approval bypass on the Streamable HTTP + JWT + elicitation path, and memory-note materialization that could overwrite an unrelated note or leave the graph inconsistent after a filesystem failure. Both require an authorized caller and the caller's ordinary tool permissions.
Why it matters
A governed agent MCP server is meant to enforce human approval for destructive operations; a HITL bypass means an agent could delete or rewrite vault content without genuine human consent, while the note-collision flaw silently destroys unrelated data. Niche package, hence Tier C.
Attack vector
CVE-2026-115477: the server trusts an authentic call-bound state as proof of approval even though that state was minted before the elicitation/create leg was asked, so a misbehaving or attacker-controlled client can execute dispatch-gated destructive vault operations without human approval (CWE-285/863). CVE-2026-115478: entity tools regenerate memory notes at a computed path without preserving ownership, allowing a hand-authored note or an orphan whose name sanitized to the same path to be overwritten, and SQLite is mutated before fallible filesystem work so a failure leaves the graph inconsistent (CWE-459/863).
Affected systems
obsidian-tc 1.13.0–1.31.4 (CVE-2026-115477) and 1.0.1–1.31.4 (CVE-2026-115478); fixed in 1.31.4
Mitigation
Upgrade obsidian-tc to 1.31.4 (GHSA-737x-cwfr-5vvc and GHSA-r3g7-r4hr-m258). Where snapshots are enabled, use restore_note to mitigate overwrites; treat client-provided elicitation state as untrusted.