CVE-2026-77366

Summary

The vulnerability allows authenticated users to access any configured vault through tool dispatch functions, bypassing normal access controls by using mismatched vault identifiers in requests. This creates a critical privilege escalation vector where attackers can read, write, or delete data across multiple vaults.

Exploitability

Easy to exploit with valid authentication tokens; attackers need only manipulate the input.vault parameter to target other vaults without requiring additional credentials or complex payloads.

Blast radius

The vulnerability affects all users with valid tokens who can access the tool dispatch endpoints, potentially exposing multiple vaults' contents to unauthorized access across an entire Obsidian vault ecosystem.

Detection

Monitor for requests with mismatched vault identifiers in tool dispatch operations where the caller's token context doesn't match the requested vault, particularly in file read/write/delete operations.

Prioritized remediation

Upgrade to version 1.3.1 which fixes the vault binding and input validation issues in the tool dispatch functionality.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.