Obsidian-Tc - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/obsidian-tc/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 21:49:02 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgObsidian obsidian-tc: HITL confirmation bypass in tool execution (CVE-2026-115477)https://feed.craftedsignal.io/briefs/2026-10-obsidian-tc-hitl-bypass/Fri, 23 Oct 2026 21:49:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-obsidian-tc-hitl-bypass/A vulnerability in the obsidian-tc server allows malicious or non-compliant clients to execute destructive tool calls by echoing validly bound request states even after a human-in-the-loop confirmation is declined.A vulnerability (CVE-2026-115477) exists in the obsidian-tc server component (v1.13.0 through v1.31.3) where the server fails to properly validate human-in-the-loop (HITL) confirmation responses. When a client performs a dispatch-gated tool call, the server issues an inputRequired confirmation challenge. Due to a flaw in the validation logic, the server trusts the echoed requestState provided by the client upon resubmission as proof of approval, even if the user previously declined the action. A malicious or non-compliant client can echo this state to bypass the user's explicit refusal, allowing destructive operations such as file deletion, cross-folder moves, and frontmatter replacements.

Impact

Successful exploitation allows for unauthorized execution of destructive vault operations that a user explicitly declined. The impact is limited to dispatch-gated tools configured with destructive: true or HITL floor scopes. The server cannot verify if a client actually rendered the form to the human, meaning an attacker-controlled client can simply provide an approval response regardless of human input.

Recommendation

  • Patch obsidian-tc to version 1.31.4 or later immediately.
  • For environments unable to patch, transition to stdio-based deployments or unset auth.jwtSecret to force usage of the legacy CLI-based elicit_token mechanism.
  • Audit logs for suspicious tool call patterns where a rejection is followed by an immediate resubmission from the same client session.
]]>highadvisoryvulnerabilityhitl-bypassobsidian-tc