Obsidian obsidian-tc: HITL confirmation bypass in tool execution (CVE-2026-115477)

A vulnerability (CVE-2026-115477) exists in the obsidian-tc server component (v1.13.0 through v1.31.3) where the server fails to properly validate human-in-the-loop (HITL) confirmation responses. When a client performs a dispatch-gated tool call, the server issues an inputRequired confirmation challenge. Due to a flaw in the validation logic, the server trusts the echoed requestState provided by the client upon resubmission as proof of approval, even if the user previously declined the action. A malicious or non-compliant client can echo this state to bypass the user's explicit refusal, allowing destructive operations such as file deletion, cross-folder moves, and frontmatter replacements.

Impact

Successful exploitation allows for unauthorized execution of destructive vault operations that a user explicitly declined. The impact is limited to dispatch-gated tools configured with destructive: true or HITL floor scopes. The server cannot verify if a client actually rendered the form to the human, meaning an attacker-controlled client can simply provide an approval response regardless of human input.

Recommendation

• Patch obsidian-tc to version 1.31.4 or later immediately.
• For environments unable to patch, transition to stdio-based deployments or unset auth.jwtSecret to force usage of the legacy CLI-based elicit_token mechanism.
• Audit logs for suspicious tool call patterns where a rejection is followed by an immediate resubmission from the same client session.