CVE-2026-77363
obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback
The Streamable HTTP transport was constructed without enableDnsRebindingProtection/allowedHosts/allowedOrigins and performed no Origin-header validation. With the documented auth.mode: "none" loopback default, a drive-by web page could POST http://127.0.0.1/mcp and receive caller http-local with scopes ["*"] — full vault read/write — via DNS rebinding / a forged Origin.
- The-40-Thieves obsidian-tc
- Critical
- CVSS 9.6
- EPSS 0.16%
- Fixed version listed
What to do
Fixed version listed
Affected packages
| Package | Affected | Fixed in | Advisory |
|---|---|---|---|
| obsidian-tc (npm) | < 1.3.1 | 1.3.1 | GHSA-pqh8-4pj7-32xx |
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.6 (v3.1, scored by GitHub)
- EPSS
- 0.16% chance of exploitation in the next 30 days (EPSS from FIRST, as of Oct 23, 2026)
- CISA's SSVC decision points
- Exploitation: none. Automatable: no. Technical impact: total. As of Oct 13, 2026.
- Weakness
- CWE-346: Origin Validation Error; CWE-1385: Missing Origin Validation in WebSockets
- Vendor
- The-40-Thieves, obsidian-tc
Timeline
- GitHub published advisory GHSA-pqh8-4pj7-32xx (critical). Fixed in 1.3.1.