# CVE-2026-114090: MCP Servers on Developer Machines: Trigger.dev's Dev MCP Server Listened on All Interfaces With No Auth (CVE-2026-114090), obsidian-tc Ran Destructive Tools After the Human Said No, and Three Unpatched npm MCP Servers Allow Code Execution

> CVE-2026-114090 is a high-severity remote code execution issue (CVSS 7.6) in obsidian-tc, a MCP server. Affected: >=1.0.1 <1.31.4. Fixed in 1.31.4.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-114090
- **Aliases:** ti-154
- **Severity:** high
- **CVSS:** 7.6
- **Attack type:** Remote code execution, Authentication bypass
- **Component:** obsidian-tc (MCP server)
- **Package:** obsidian-tc (npm)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-10-23
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-114090

## Summary

Several MCP server CVEs published 21 to 23 October 2026 affect servers developers run locally. CVE-2026-114090 (CVSS 7.6): `trigger dev --mcp` in Trigger.dev cli-v3 3.0.0 to before 4.5.4 bound its MCP server to all network interfaces and exposed /sse and /messages without authentication, so anyone on the LAN, or a malicious web page, could call trigger-task, cancel-run, list-runs and get-run-logs with the developer's stored Trigger.dev access token; fixed in 4.5.4. obsidian-tc, an MCP server for Obsidian vaults, published two advisories on 23 October: CVE-2026-115477 (CVSS 7.1), where a destructive tool call over Streamable HTTP still completed after the human declined or cancelled the confirmation, because the server took the echoed request state as proof of approval, and CVE-2026-115478, where memory tools overwrote hand-written notes sitting at the same path; both are fixed in 1.31.4. NVD also published CVE-2026-106765 (@rog0x/mcp-docker-tools 1.0.1, handleImageList), CVE-2026-106764 (@rog0x/mcp-git-tools 1.0.1, resolveBaseBranch) and CVE-2026-106763 (@justice8096/sagemath-mcp-server 1.0.1, escapeShellString and sanitizeCode), each described as allowing arbitrary code execution, with no fixed version published.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| >=1.0.1 <1.31.4 | 1.31.4 |

## Am I affected by CVE-2026-114090?

You are affected if you run obsidian-tc >=1.0.1 <1.31.4. Versions 1.31.4 and later include the fix.

## How do I fix CVE-2026-114090?

Upgrade the Trigger.dev CLI to 4.5.4 or later and rotate the Trigger.dev access token on machines that ran trigger dev --mcp on an untrusted network. Upgrade obsidian-tc to 1.31.4 or later and back up any vault it can write. Remove @rog0x/mcp-docker-tools, @rog0x/mcp-git-tools and @justice8096/sagemath-mcp-server from MCP client configs. In general, run local MCP servers over stdio where the client supports it; when HTTP is needed, bind to 127.0.0.1, require a token and check the Origin header.

## How do I find every machine running obsidian-tc?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run obsidian-tc and which version, then enforce a policy on it.

## References

- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-114090

## Related vulnerabilities

- [CVE-2026-114612](https://catalog.anomity.ai/vuln/cve-2026-114612) — critical
- [CVE-2026-107824](https://catalog.anomity.ai/vuln/cve-2026-107824) — critical
- [CVE-2026-33032](https://catalog.anomity.ai/vuln/cve-2026-33032) — critical
- [GHSA-53mr-w429-c597](https://catalog.anomity.ai/vuln/ghsa-53mr-w429-c597) — high
- [GHSA-7xgj-8392-5q4r](https://catalog.anomity.ai/vuln/ghsa-7xgj-8392-5q4r) — medium
- [CVE-2025-49596](https://catalog.anomity.ai/vuln/cve-2025-49596) — critical

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-114090