AdvisoriesToolsStatsChecklistSubmitGet the email
← All advisories
CVE-2026-54618criticalBroken access control2026-09-17

CVE-2026-54618: Obsidian Web MCP hands out vault access without a login

Before 0.2.0, Obsidian Web MCP's /oauth/authorize issues an authorization code with no login or consent, and /oauth/token swaps it for the static VAULT_MCP_TOKEN. Anyone who can reach the tunnel can read, write, move and delete notes in the whole vault.

01.

What it is

/oauth/authorize auto-approves and issues an authorization code without any login, consent or session check, and /oauth/token exchanges that code for the static VAULT_MCP_TOKEN without authenticating the client.

With that token, an unauthenticated remote caller who can reach the intended tunnel deployment can call /mcp and use vault_read, vault_write, vault_search, vault_list, vault_move and vault_delete against the entire vault. Optional PKCE doesn't stop an attacker-started flow.

02.

How to check

  1. Affected: jimprosser/obsidian-web-mcp 0.1.0 and earlier.
  2. Check whether your instance is exposed through a tunnel or public URL.
03.

How to fix

  1. Upgrade to obsidian-web-mcp 0.2.0 or later.
  2. Change VAULT_MCP_TOKEN after upgrading, and review the vault for unexpected edits or deletions if it was exposed.
git -C obsidian-web-mcp describe --tags
04.

Sources

More advisories for this tool
The weekly email

One email a week. Only what changed.

New advisories, CVEs and fixes for Lovable, Bolt, v0, Replit, Base44 and Cursor apps. No roundups of things you already read.

Free. The list is new, so the first issues go out once there are readers. Unsubscribe from any email in one click. We never sell or share addresses.