GitHub Advisoryadvisory · npm

GHSA-pqh8-4pj7-32xx obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

CRITICAL Published 2026-10-23 Modified 2026-10-23 Official page ↗
Aliases
CVE-2026-77363
Ecosystem
npm
Packages
obsidian-tc
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-1385, CWE-346
Reviewed
2026-10-23

Affected packages

• npm obsidian-tc: < 1.3.1 → fixed in 1.3.1

Description

Impact The Streamable HTTP transport was constructed without `enableDnsRebindingProtection`/`allowedHosts`/`allowedOrigins` and performed no `Origin`-header validation. With the documented `auth.mode: "none"` loopback default, a drive-by web page could `POST http://127.0.0.1/mcp` and receive caller `http-local` with scopes `["*"]` — full vault read/write — via DNS rebinding / a forged Origin. Patches Fixed in 1.3.1. Upgrade to `>= 1.3.1`. The transport now enables DNS-rebinding protection and allowed hosts/origins and returns HTTP 403 on an invalid Origin (per MCP 2025-11-25). Workarounds Do not expose the HTTP transport with `auth.mode: "none"`; require JWT auth, or bind to a non-loopback interface behind a proxy that validates `Origin`.

Related

Alias · CVE (1)

  • CVE-2026-77363 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. vulnerability

Weakness · CWE (2)

  • CWE-1385 Missing Origin Validation in WebSockets weakness
  • CWE-346 Origin Validation Error weakness

References