CVE-2026-57441: MCPVault Path Traversal Vulnerability

CVE-2026-57441 Overview

CVE-2026-57441 is a path filter bypass vulnerability in MCPVault, a lightweight Model Context Protocol (MCP) server that mediates AI agent access to files in an Obsidian vault. Versions prior to 0.11.4 compile restricted-directory patterns case-sensitively and compare paths without canonicalizing filesystem-equivalent segment names. On case-insensitive macOS and Windows filesystems, case variants of .git, .obsidian, or node_modules bypass the deny list. Windows trailing dots or spaces provide the same bypass. An attacker who influences a path selected by an AI agent can read, write, move, search, or list sensitive repository and Obsidian metadata.

Critical Impact
Attackers who influence AI agent path selection can access or modify .git, .obsidian, and node_modules directories on macOS and Windows, exposing repository secrets and vault metadata.

Affected Products

MCPVault versions prior to 0.11.4
Deployments on case-insensitive filesystems (macOS default, Windows NTFS)
Windows deployments (susceptible to trailing dot and space normalization bypass)

Discovery Timeline

2026-09-15 - CVE-2026-57441 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-57441

Vulnerability Analysis

MCPVault exposes files to AI agents through the Model Context Protocol and enforces a deny list of sensitive directories with the PathFilter class in src/pathfilter.ts. The filter compares user-supplied paths against restricted patterns such as .git, .obsidian, and node_modules using case-sensitive string matching. It also compares paths without stripping Windows-equivalent segment suffixes.

Both isAllowed() and isAllowedForListing() return true for inputs like .Git, .OBSIDIAN, .git., or .git (trailing space). The underlying operating system then resolves these variants to the real restricted directory. The filter's decision and the filesystem's resolution disagree, which produces a classic filter bypass. The tracked weakness is CWE-41: Improper Resolution of Path Equivalence.

An attacker who can influence any path passed by an AI agent into MCPVault operations can read Git history and configuration, exfiltrate .git/config credentials, tamper with Obsidian plugin settings, or write malicious files into node_modules. Vault-root .. containment is unaffected; the bypass operates entirely inside the vault root.

Root Cause

The root cause is missing path canonicalization before deny-list comparison. PathFilter treats path strings literally rather than folding them to the form the filesystem will actually open. Case-insensitive filesystems (APFS on macOS, NTFS on Windows) and Windows segment-suffix stripping create equivalence classes that the filter never accounts for.

Attack Vector

Exploitation requires local access and user interaction, typically an AI agent acting on attacker-influenced input (for example, a crafted prompt, a poisoned document, or a malicious tool call). The attacker supplies a path such as .Git/config or .git.\config to a read, write, move, search, or list operation. PathFilter permits the operation, and the OS opens the real restricted directory.

typescript

// Patch: dist/src/pathfilter.d.ts adds canonicalizeForMatch()
     private allowedExtensions;
     constructor(config?: Partial<PathFilterConfig>);
     private simpleGlobMatch;
+    /**
+     * Canonicalize a path for restricted-directory matching. On Windows the
+     * filesystem strips trailing dots and spaces from each path segment, so
+     * ".git." and ".git " both resolve to ".git". Fold those away (and collapse
+     * "./" / duplicate separators) before matching the deny-list, otherwise the
+     * restriction can be bypassed with an equivalent name.
+     */
+    private canonicalizeForMatch;
     isAllowed(path: string): boolean;
     isAllowedForListing(path: string): boolean;
     private isIgnoredPath;

Source: GitHub Commit b9ea91a

Detection Methods for CVE-2026-57441

Indicators of Compromise

MCP tool invocations referencing case-variant restricted directory names such as .Git, .GIT, .Obsidian, or Node_Modules.
Paths ending in a trailing dot or trailing space on Windows hosts, for example .git. or .git .
Unexpected reads or writes to .git/config, .git/hooks/, .obsidian/plugins/, or files under node_modules/.
MCPVault process activity opening files inside restricted directories while returning success to the agent.

Detection Strategies

Enable request logging in MCPVault and alert on paths whose normalized form matches a restricted directory but whose raw form differs in case or trailing characters.
Correlate AI agent tool-call telemetry with filesystem access events on .git, .obsidian, and node_modules.
Monitor Git repositories under MCPVault-managed vaults for unexpected modifications to hooks, config, or credential helpers.

Monitoring Recommendations

Inventory all MCPVault deployments and record installed versions; flag anything below 0.11.4.
Ship MCPVault stdout and stderr to a central log store and retain agent path arguments for post-incident review.
Baseline expected AI agent path patterns and alert on new segment names containing mixed case or trailing whitespace.

How to Mitigate CVE-2026-57441

Immediate Actions Required

Upgrade MCPVault to version 0.11.4 or later on every host, prioritizing macOS and Windows systems.
Restrict MCPVault to vaults that do not contain live Git repositories or production secrets until patched.
Review recent AI agent activity for path arguments containing case variants of restricted directories or Windows trailing characters.

Patch Information

The fix is delivered in MCPVault 0.11.4. The patch introduces a private canonicalizeForMatch routine in src/pathfilter.ts that folds case, strips Windows trailing dots and spaces per segment, and collapses ./ and duplicate separators before comparing against the deny list. See the GitHub Security Advisory GHSA-j99q-93c9-h869 and the fix commits 0adb439 and b9ea91a.

Workarounds

Run MCPVault only against vaults stored on case-sensitive filesystems (for example, a case-sensitive APFS volume on macOS or ext4 on Linux).
Remove .git, .obsidian, and node_modules from any vault exposed to MCPVault, or relocate the vault outside repositories.
Constrain the AI agent's tool schema to require pre-validated paths from an allow list rather than free-form strings.

bash

# Upgrade MCPVault to the patched release
npm install -g mcpvault@0.11.4

# Verify the installed version
mcpvault --version

# Optional: create a case-sensitive APFS volume for the vault on macOS
diskutil apfs addVolume disk1 "Case-sensitive APFS" VaultCS