Zero Radar
← feed
HighVulnerabilityCVE-2026-115477updated 25 Oct 2026, 13:32 UTC

Obsidian MCP server could run destructive vault actions after user declined

An AI assistant connected to your Obsidian notes could delete or move notes even after you clicked 'decline' on the confirmation prompt. This happens only when the client itself sends a fake or incorrect approval.

Partial fixOfficial, 2 sources
SeverityHighCVSS 7.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Partly1.31.4 · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1User declinesHuman refuses the confirmation prompt
  2. 2Client echoes stateResubmits the valid requestState anyway
  3. 3Server trusts stateApproval check skipped the elicitation response
  4. 4Vault modifiedDestructive operation completes
  5. ResultDeclined destructive vault operation still runs

What happened

In obsidian-tc (an MCP server for Obsidian vaults), dispatch-gated tools marked destructive or requiring HITL approval could complete after the elicitation was declined, cancelled, or malformed, if the client echoed the valid requestState; the server trusted that state as approval.

Why it is dangerous: A compliant client acting incorrectly, or a client controlled by an attacker, can delete, move, or rewrite vault content that the human explicitly refused, with the server not enforcing the refusal.

Are you affected?

You are affected if you run obsidian-tc 1.13.0 through 1.31.3 as a Streamable HTTP server with auth.jwtSecret set and use a 2026-07-28-era client that supports elicitation forms.

Package / productAffected versionsFixed in
obsidian-tc · npm>= 1.13.0, <= 1.31.31.31.4

What to do

  1. Update obsidian-tc to 1.31.4 or later
  2. Until updated, run the server over stdio or leave auth.jwtSecret unset
  3. Review clients you connect to, since a malicious client can still fake approval

Timeline

  1. 23 Oct 2026, 15:17 UTC
    Publicly disclosed
  2. 23 Oct 2026, 15:17 UTC
    Reported by NVD · NVD
  3. 23 Oct 2026, 17:30 UTC
    Reported by GitHub Advisory · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-115477 · GHSA-737x-cwfr-5vvc
CVSS
7.1 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 15:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Obsidian MCP server could run destructive vault actions after user declined · Zero Radar