CVE-2026-77363

Summary

obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

Severity

critical

CVSS

9.6

EPSS

0.2% (p5)

CWE

CWE-346, CWE-1385

Also known as

GHSA-pqh8-4pj7-32xx

Published

2026-10-23

Updated

2026-10-23

Advisory details

Impact

The Streamable HTTP transport was constructed without enableDnsRebindingProtection/allowedHosts/allowedOrigins and performed no Origin-header validation. With the documented auth.mode: "none" loopback default, a drive-by web page could POST http://127.0.0.1/mcp and receive caller http-local with scopes ["*"] — full vault read/write — via DNS rebinding / a forged Origin.

Patches

Fixed in 1.3.1. Upgrade to >= 1.3.1. The transport now enables DNS-rebinding protection and allowed hosts/origins and returns HTTP 403 on an invalid Origin (per MCP 2025-11-25).

Workarounds

Do not expose the HTTP transport with auth.mode: "none"; require JWT auth, or bind to a non-loopback interface behind a proxy that validates Origin.

References

• https://github.com/advisories/GHSA-pqh8-4pj7-32xx
• https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-pqh8-4pj7-32xx
• https://github.com/The-40-Thieves/obsidian-tc/pull/74
• https://github.com/The-40-Thieves/obsidian-tc/commit/6428bfe6fdfd43aa7b4b369be3aecd6a268fb928
• https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1
• https://nvd.nist.gov/vuln/detail/cve-2026-77363

Related advisories

• CVE-2026-59950 — high · PyPI/mcp
• CVE-2026-77366 — critical · npm/obsidian-tc
• CVE-2026-115478 — high · npm/obsidian-tc
• CVE-2026-115477 — high · npm/obsidian-tc
• CVE-2026-77362 — medium · npm/obsidian-tc
• CVE-2026-77364 — medium · npm/obsidian-tc
• CVE-2026-77361 — medium · npm/obsidian-tc
• CVE-2026-114125 — critical · npm/storybook

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity