obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
CVE-2026-115477
Summary On a Streamable HTTP deployment with auth.jwtSecret configured, serving a 2026-07-28-era client that declared elicitation.form support, a call to a dispatch-gated tool (destructive: true, or a scope with an HITL floor) that was offered an inputRequired confirmation could still complete after the human declined, cancelled, or the elicitation response was omitted or malformed, provided the client echoed the validly bound requestState on resubmission. The server trusted an authentic, call-bound state as proof of approval; the state is minted before the elicitation leg is asked, so it proves only that the resubmission belongs to the same call. Details Reproduced directly: a destructive: true tool call, offered inputRequired, answered with {action: "decline"} on the elicitation/create leg, still wrote. Present since the 2026-07-28 round trip shipped in v1.13.0 (THE-583). Only dispatch-gated tools were reachable; the sixteen handler-side conditionally gated tools (writenote overwrite, movenote, and others) did not read the elicitation state on the modern wire at all, so they neither let a decline nor an approval through. Impact A client that echoes state after a decline can…
Assessment
- CVSS
- 7.1 (v4.0)
- Severity
- High
- EPSS
- 0.00354% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 23 October 2026
- Last updated
- 23 October 2026
- Affected
- npm · obsidian-tc
- Weakness
- CWE-285, CWE-863
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
At the source
References
- https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-737x-cwfr-5vvc
- https://github.com/The-40-Thieves/obsidian-tc/issues/967
- https://github.com/The-40-Thieves/obsidian-tc/pull/969
- https://github.com/The-40-Thieves/obsidian-tc/commit/101c91c656e2c2b88bcf3696a5da035f8c032c71
- https://github.com/The-40-Thieves/obsidian-tc/blob/v1.31.4/CHANGELOG.md
- https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.31.4
- https://nvd.nist.gov/vuln/detail/cve-2026-115477
- https://github.com/advisories/GHSA-737x-cwfr-5vvc
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-115477