Skip to main content
← All vulnerabilities
CVE-2026-115478EUVD-2026-109083GHSA-R3G7-R4HR-M258

obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

Affects obsidian-tc from 1.0.1 through 1.31.3 when an authorized caller with memory-write scope uses the M5 memory tools on an existing note not owned by the written entity. Fixed in 1.31.4.

Published
Last modified
published
Not listed in CISA KEV
Specific setups only
Fix
Fixed in 1.31.4
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

obsidian-tc, a Model Context Protocol server for Obsidian vaults, is affected through its memory-lifecycle tools (create, link, rename, unlink, and delete entity). Flaws in how these tools write memory notes and update their database can overwrite the body of a hand-authored or unrelated vault note, or leave the memory database out of sync with the notes on disk after a failed operation.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLite at the computed `memory/<type>/<name>.md` path without reliably preserving note ownership or the consistency of a failed lifecycle operation. During shared materialization, a hand-authored note or an orphan left by a different entity whose name sanitized to the same path could have its entire body overwritten on the next write naming that type and name, with non-owned frontmatter preserved. `rename_entity` also seeded the destination path with a direct atomic write without validating ownership and could overwrite a foreign note there. Separately, several tools mutated SQLite before fallible filesystem work: `create_entity` and `link_entities` inserted the row or relation before materialization; `rename_entity` updated the entity, including a retired status, before updating its note; `unlink_entities` removed a relation before rematerializing the source note; and `delete_entity`'s cascade removed the target and its relations before rematerializing neighbouring notes. A later filesystem failure could therefore leave a row or relation changed and the memory graph inconsistent with the notes on disk even when the operation failed. An authorized caller with the required memory-tool permissions could, without intending to, destroy the body of a vault note outside the entity being written; `delete_entity` additionally requires its deletion permission and destructive confirmation, which this memory flaw does not bypass. Snapshots-before-write through `restore_note` mitigate the overwrite only where snapshots are enabled and the note had previously been written through obsidian-tc. This issue is fixed in version 1.31.4.

Timeline

  1. CVE published
  2. First seen by cve.now
  3. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  4. Record last updated

Affected versions

  • The-40-Thieves obsidian-tc

    From 1.0.1 · fixed in 1.31.4

  • obsidian-tcnpm

    From 1.0.1 · fixed in 1.31.4

References 5

GitHub · The-40-Thieves/obsidian-tc

FAQ

Questions about CVE-2026-115478

What does this mean?

When the M5 memory tools write an entity whose computed note path already holds a note the entity does not own, the existing note's body can be overwritten. The memory graph can then disagree with the notes on disk.Source: github.com

Am I affected, and how do I check?

Versions 1.0.1 through 1.31.3 of the obsidian-tc npm package are affected, and only when the caller has memory-write scope and uses the M5 memory tools. To check, look at the installed obsidian-tc version in your package manifest or lockfile.Source: github.com

What should I do about it?

Upgrade obsidian-tc to 1.31.4 or later, which fixes the issue at the shared write primitive.Source: github.com

Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data