CVE-2026-77363: obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback
Impact The Streamable HTTP transport was constructed without enableDnsRebindingProtection/allowedHosts/allowedOrigins and performed no Origin-header validation. With the documented auth.mode: "none" loopback default, a drive-by web page could POST http://127.0.0.1/mcp and receive caller http-local with scopes [""] — full vault read/write — via DNS rebinding / a forged Origin. Patches Fixed in 1.3.1.
Published Oct 23, 2026
Affected packages
obsidian-tc
- Ecosystem
- npm
- Affected
- < 1.3.1
- Fixed in
- 1.3.1
- Check
npm ls obsidian-tc
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
The Streamable HTTP transport was constructed without enableDnsRebindingProtection/allowedHosts/allowedOrigins and performed no Origin-header validation. With the documented auth.mode: "none" loopback default, a drive-by web page could `POST http://127.0.0.1/mcp` and receive caller http-local with scopes ["*"] — full vault read/write — via DNS rebinding / a forged Origin.
Patches
Fixed in 1.3.1. Upgrade to >= 1.3.1. The transport now enables DNS-rebinding protection and allowed hosts/origins and returns HTTP 403 on an invalid Origin (per MCP 2025-11-25).
Workarounds
Do not expose the HTTP transport with auth.mode: "none"; require JWT auth, or bind to a non-loopback interface behind a proxy that validates Origin.
Credited to suavecito585.
References
- https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-pqh8-4pj7-32xx
- https://github.com/The-40-Thieves/obsidian-tc/pull/74
- https://github.com/The-40-Thieves/obsidian-tc/commit/6428bfe6fdfd43aa7b4b369be3aecd6a268fb928
- https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1
- https://nvd.nist.gov/vuln/detail/cve-2026-77363
- https://github.com/advisories/GHSA-pqh8-4pj7-32xx
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology