The-40-Thieves vulnerabilities
We track 4 vulnerabilities in The-40-Thieves products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 23, 2026.
Latest The-40-Thieves vulnerabilities
- 7.1 High severity
obsidian-tc: Incomplete Cleanup
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLite at the computed `mem
- 7.1 High severity
obsidian-tc: Improper Authorization
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` configured and a 2026-07-28-era client declaring `elicitation.form` support, a dispatch-ga
- 9.9 Critical severity
obsidian-tc: Authorization Bypass Through User-Controlled Key
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) has no vault claim, an
- 8.8 High severity
obsidian-tc: Origin Validation Error
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration u