Product
A vulnerability in the obsidian-tc server allows malicious or non-compliant clients to execute destructive tool calls by echoing validly bound request states even after a human-in-the-loop confirmation is declined.