CVE-2026-115477: 
JavaScript vulnerability analysis and mitigation

CVE-2026-115477 is an improper authorization vulnerability in obsidian-tc, a Model Context Protocol (MCP) server for Obsidian vaults, that allows a client to bypass human-in-the-loop (HITL) confirmation gates and execute destructive vault operations without user approval. It affects versions >= 1.13.0 and < 1.31.4 (i.e., through v1.31.3), introduced when the 2026-07-28 inputRequired round trip shipped in v1.13.0. The vulnerability was reported by researcher suavecito585, disclosed via GitHub Advisory GHSA-737x-cwfr-5vvc on September 26, 2026, and patched in v1.31.4. It carries a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Feedly).

The root cause is improper authorization (CWE-285, CWE-863) in the tools/call handler of packages/server/src/mcp/server.ts. When a Streamable HTTP deployment has auth.jwtSecret configured and a 2026-07-28-era client declares elicitation.form support, the server issues an inputRequired confirmation prompt for dispatch-gated destructive tool calls. However, the server mints the requestState token before the elicitation/create leg is sent to the client, meaning the token only proves the resubmission belongs to the same call — not that the human approved it. A client that echoes the valid requestState on resubmission after declining, cancelling, or omitting the elicitation response would still have the call complete, because the server never checked the confirm leg's own inputResponse for {action: "accept", content: {approve: true}}. Only dispatch-gated tools (destructive: true or HITL-floored scopes) were reachable via this bypass; the 16 handler-side conditionally gated tools (write_note overwrite, move_note, etc.) were separately unaffected because vault/hitl.ts's requireConfirmation never read ctx.elicitState at all on the modern wire. Deployments using stdio or leaving auth.jwtSecret unset were not affected, as they used the CLI elicit_token fallback path (GitHub Advisory, PR #969).

An attacker with valid tool permissions operating through a compliant but misbehaving or attacker-controlled MCP client can execute destructive vault operations — including note deletion, cross-folder moves, frontmatter replacement, and link rewrites — that the human vault owner explicitly declined or never approved. The integrity impact is high, as vault content can be irreversibly modified or destroyed without user consent; availability is also lowly impacted due to potential data loss. Confidentiality is not directly impacted by this vulnerability. The attack is scoped to the Obsidian vault managed by the affected server instance and does not provide a path to lateral movement beyond vault operations, but destructive writes could result in permanent loss of notes or sensitive vault data (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to already possess valid tool permissions on the affected MCP server and to control or manipulate a client that declares elicitation.form support over a Streamable HTTP transport with auth.jwtSecret configured — a relatively narrow precondition. No threat actor attribution has been reported.

1. Identify a vulnerable deployment: Locate an obsidian-tc instance running v1.13.0–v1.31.3 over Streamable HTTP with auth.jwtSecret configured, serving a 2026-07-28-era MCP client that declares elicitation.form support.
2. Obtain valid tool permissions: Authenticate to the MCP server with credentials that grant access to dispatch-gated destructive tools (e.g., delete_note, tools marked destructive: true).
3. Initiate a destructive tool call: Send a tools/call request for a dispatch-gated destructive tool (e.g., delete_note or a tool with an HITL-floored scope). The server responds with an inputRequired confirmation prompt and a bound requestState token.
4. Decline or omit the elicitation response: On the elicitation/create leg, respond with {action: "decline"}, send a malformed response, or omit the response entirely — simulating a human refusal.
5. Resubmit with the valid requestState: Craft a resubmission of the original tool call that echoes the validly bound requestState token received in step 3. Because the server only validates that the state is authentic and call-bound (not that the human approved), the call completes and the destructive vault operation executes without human consent (GitHub Advisory, PR #969).

• Logs: MCP server audit logs (tc.elicit.* MORGIANA events) showing a tc.elicit.consumed event for a dispatch-gated tool call where no corresponding tc.elicit.in_band approval event or CLI elicit_token issuance preceded it; elicitation/create leg logged with a decline or cancel outcome followed immediately by a successful tool dispatch for the same call.
• Network: Streamable HTTP requests to the MCP server's tools/call endpoint for destructive tools (e.g., delete_note, move_note) that include a requestState parameter on resubmission without a preceding accepted elicitation/create response in the same session.
• File System: Unexpected deletion, movement, or modification of Obsidian vault notes (especially in paths not recently accessed by the user); vault files with altered frontmatter or rewritten links that the user did not authorize.
• Application Behavior: Vault operations completing for tools marked destructive: true in server logs despite the human having declined or not responded to a confirmation prompt in the MCP client UI (GitHub Advisory).

Upgrade obsidian-tc to version 1.31.4 or later, which fixes the vulnerability by requiring the confirm leg's own inputResponse to be {action: "accept", content: {approve: true}} before trusting an echoed requestState, and by suppressing any second round-trip offer after a declined confirmation (GitHub Advisory, CHANGELOG). As a temporary workaround for deployments that cannot immediately upgrade, operators can switch to stdio transport or leave auth.jwtSecret unset, which disables the requestState codec and inputRequired path entirely, falling back to the CLI elicit_token mechanism that is not affected by this bypass. Operators should also review and restrict tool permissions to limit which callers can invoke dispatch-gated destructive tools.

The vulnerability was discovered and reported by community researcher aunysillyme via GitHub Issue #967, and the security fix was credited to suavecito585 (a project maintainer) who confirmed the issue, reproduced it directly, and shipped the fix in PR #969 merged September 25, 2026 (Issue #967, PR #969). The maintainer noted in the advisory that the residual limitation — that a malicious client can still answer its own elicitation/create leg with an approval regardless of what the human said — is inherent to the client-driven half of the 2026-07-28 MCP protocol and cannot be closed server-side. No broader media coverage or significant social media discussion has been identified beyond the GitHub advisory and associated issue thread.