CVE-2026-77363GHSA-pqh8-4pj7-32xx

obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

The-40-Thieves obsidian-tcnpmLibraries & packages

CVSS

9.6Critical

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in1.3.1Fixed versionGitHub

Published12 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

1.3.1obsidian-tc, npmGitHubnpm install obsidian-tc@1.3.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

@stackflag.bsky.social: CVE-2026-77363 - obsidian-tc The Obsidian-tc server version before 1.3.1 accepts requests from any web page, even those coming from outside the local network. If the server is set Bluesky: CVE posts, 23 Oct 2026

Description

Impact

The Streamable HTTP transport was constructed without enableDnsRebindingProtection/allowedHosts/allowedOrigins and performed no Origin-header validation. With the documented auth.mode: "none" loopback default, a **drive-by web page could POST http://127.0.0.1/mcp** and receive caller http-local with scopes ["*"] — full vault read/write — via DNS rebinding / a forged Origin.

Patches

Fixed in 1.3.1. Upgrade to >= 1.3.1. The transport now enables DNS-rebinding protection and allowed hosts/origins and returns HTTP 403 on an invalid Origin (per MCP 2025-11-25).

Workarounds

Do not expose the HTTP transport with auth.mode: "none"; require JWT auth, or bind to a non-loopback interface behind a proxy that validates Origin.

Text from GitHub Advisory Database

Affected versions 3

obsidian-tc, npm< 1.3.1GitHub
obsidian-tcaffected: < 1.3.1CVE List
obsidian-tc, npmfrom first release, fixed in 1.3.1OSV