CVE-2026-57442: MCPVault Path Traversal Vulnerability

CVE-2026-57442 Overview

CVE-2026-57442 is a path traversal vulnerability [CWE-22] in MCPVault, a lightweight Model Context Protocol (MCP) server that provides AI agents with access to files in an Obsidian vault. Versions prior to 0.11.5 use root-anchored deny-list patterns in the PathFilter component defined in src/pathfilter.ts. Nested restricted directories such as .git, .obsidian, and node_modules bypass both isAllowed() and isAllowedForListing() checks. An attacker who influences a path selected by an AI agent can read repository metadata, remote URLs, embedded tokens, or pollute the listAllTags index with nested node_modules content.

Critical Impact
Attackers can coerce an AI agent into reading sensitive files inside nested .git and .obsidian directories, exposing credentials and remote repository tokens.

Affected Products

MCPVault versions prior to 0.11.5
Deployments exposing an MCP server to AI agents against an Obsidian vault
Environments where vault directories contain nested repositories or node_modules trees

Discovery Timeline

2026-09-15 - CVE-2026-57442 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-57442

Vulnerability Analysis

MCPVault exposes filesystem operations to AI agents through the Model Context Protocol. The PathFilter class enforces which paths agents may read or list. The filter maintains a deny list for sensitive directories including .git, .obsidian, and node_modules. However, the patterns are anchored at the vault root and only match top-level occurrences.

When a vault contains nested repositories or module trees, requests to paths such as notes/project/.git/config or plugins/foo/node_modules/leaky-package/secrets.env bypass the deny list. Both isAllowed() and isAllowedForListing() return true, so the server serves the file contents and includes them in tag indexing operations.

The impact depends on what the nested directories contain. A nested .git/config can expose remote URLs with embedded credentials. A nested .obsidian/workspace.json may leak plugin state or synchronization tokens. Polluting listAllTags with node_modules content can degrade AI agent behavior and leak third-party file contents into agent context windows.

Root Cause

The root cause is a matching-logic error in src/pathfilter.ts. The deny-list patterns were written as root-anchored globs rather than segment-aware rules. The fix introduces a RESTRICTED_SEGMENTS set that is checked against every path segment, not just the leading one.

Attack Vector

Exploitation requires local access to the MCP server and user interaction, because the attacker must influence which path an AI agent selects. This typically occurs through prompt injection in vault content, malicious Markdown notes, or manipulated tool arguments passed to the agent.

typescript

// Patch excerpt from dist/src/pathfilter.d.ts
 import type { PathFilterConfig } from "./types.js";
 export declare class PathFilter {
+    private static readonly RESTRICTED_SEGMENTS;
     private ignoredPatterns;
     private allowedExtensions;
     constructor(config?: Partial<PathFilterConfig>);

Source: GitHub Commit 8795716. The patch adds a static RESTRICTED_SEGMENTS list, enabling per-segment checks that catch nested .git, .obsidian, and node_modules directories.

Detection Methods for CVE-2026-57442

Indicators of Compromise

MCP server logs showing successful reads of paths containing /.git/, /.obsidian/, or /node_modules/ as non-leading segments.
Agent transcripts or tool-call histories referencing files under nested repository metadata directories.
Unexpected growth or foreign entries in the listAllTags output that map back to node_modules content.

Detection Strategies

Audit MCPVault access logs for requests where the resolved path contains restricted segments anywhere other than the root position.
Diff current listAllTags output against a known-good baseline to identify tag pollution from nested module trees.
Inventory Obsidian vaults for nested .git repositories that may contain credentialed remote URLs.

Monitoring Recommendations

Continuously monitor MCP server process activity and file reads issued on behalf of AI agents.
Alert on any AI-agent tool call whose path argument includes .git, .obsidian, or node_modules at any depth.
Track MCPVault version across deployments and flag hosts still running versions prior to 0.11.5.

How to Mitigate CVE-2026-57442

Immediate Actions Required

Upgrade MCPVault to version 0.11.5 or later on all hosts exposing an MCP server.
Rotate any credentials, tokens, or Git remote secrets stored in nested .git or .obsidian directories within served vaults.
Review recent AI agent transcripts for evidence of reads against nested restricted directories.

Patch Information

The fix is delivered in MCPVault 0.11.5. The corrective changes are tracked in GitHub Commit 0adb439 and GitHub Commit 8795716, with background in GitHub Issue #128 and the GitHub Security Advisory GHSA-9c83-rr99-vfwj. The patch introduces a static RESTRICTED_SEGMENTS set and applies per-segment matching in PathFilter.

Workarounds

Remove or relocate nested .git, .obsidian, and node_modules directories from any vault served by MCPVault until the upgrade is applied.
Restrict MCPVault to vaults that contain only user notes, excluding source-controlled subprojects.
Limit which AI agents and tools can invoke MCPVault, and constrain the path arguments they can supply.

bash

# Upgrade MCPVault to the fixed release
npm install -g mcpvault@0.11.5

# Verify installed version
mcpvault --version