{ "schemaVersion": 1, "site": "https://cveboard.org", "generatedAt": "2026-10-23T19:19:34.949Z", "lastRun": "2026-10-23T19:01:02.861Z", "liveDays": 14, "filters": { "kind": null, "exploited": false, "severity": null, "ecosystems": [], "tag": "the-40-thieves" }, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "incidents": [ { "id": "cve-2026-77363", "url": "https://cveboard.org/i/cve-2026-77363", "urlPt": "https://cveboard.org/pt/i/cve-2026-77363", "json": "https://cveboard.org/i/cve-2026-77363.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback", "summary": "The Streamable HTTP transport was constructed without enableDnsRebindingProtection/allowedHosts/allowedOrigins and performed no Origin-header validation. With the documented auth.mode: \"none\" loopback default, a drive-by web page could POST http://127.0.0.1/mcp and receive caller http-local with scopes [\"*\"] — full vault read/write — via DNS rebinding / a forged Origin.", "titlePt": "obsidian-tc: transporte HTTP falta proteção Origin/DNS-rebinding, permitindo acesso drive-by ao cofre no loopback", "summaryPt": "O transporte HTTP Streamable foi construído sem enableDnsRebindingProtection/allowedHosts/allowedOrigins e não realizou validação de cabeçalho Origin. Com o modo de autenticação documentado auth.mode: \"none\" padrão de loopback, uma página web drive-by poderia POST http://127.0.0.1/mcp e receber chamada http-local com escopos [\"*\"] — leitura/gravação completa do cofre — via DNS rebinding / um Origin forjado.", "affected": [ { "vendor": "The-40-Thieves", "product": "obsidian-tc", "defaultStatus": "unknown", "versions": [ { "version": "< 1.3.1", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-346", "name": "Origin Validation Error" }, { "id": "CWE-1385", "name": "Missing Origin Validation in WebSockets" } ], "ssvc": { "exploitation": "none", "automatable": "no", "impact": "total", "at": "2026-10-13T16:02:58.070Z" }, "fix": "listed", "tags": [ "the-40-thieves", "npm" ], "cves": [ "CVE-2026-77363" ], "ghsa": "GHSA-pqh8-4pj7-32xx", "cvss": { "score": 9.6, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00157, "percentile": 0.0452, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "npm", "name": "obsidian-tc", "vulnerable": "< 1.3.1", "fixed": "1.3.1", "advisory": "GHSA-pqh8-4pj7-32xx" } ], "vendor": "The-40-Thieves", "product": "obsidian-tc", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-pqh8-4pj7-32xx" } ], "publishedAt": "2026-10-23T18:29:02.000Z", "updatedAt": "2026-10-23T18:29:02.000Z" }, { "id": "cve-2026-77366", "url": "https://cveboard.org/i/cve-2026-77366", "urlPt": "https://cveboard.org/pt/i/cve-2026-77366", "json": "https://cveboard.org/i/cve-2026-77366.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "obsidian-tc tokens can access arbitrary configured vaults", "summary": "Tool dispatch did not check the caller-supplied input.vault against the caller's bound vault (ctx.vaultId); the folder ACL was a single global instance and the JWT carried no vault claim. As a result, any valid token could read, write, or delete any configured vault by passing input.vault, defeating multi-tenant isolation across ~90 tool sites.", "titlePt": "tokens do obsidian-tc podem acessar vaults configurados arbitrários", "summaryPt": "A chamada de ferramenta não verificou a entrada.vault fornecida pelo chamador contra o vault vinculado do chamador (ctx.vaultId); o ACL da pasta era uma única instância global e o JWT não carregava nenhuma reivindicação de vault. Como resultado, qualquer token válido poderia ler, escrever ou excluir qualquer vault configurado passando input.vault, derrotando o isolamento multi-inquilino em ~90 sites de ferramentas.", "affected": [ { "vendor": "The-40-Thieves", "product": "obsidian-tc", "defaultStatus": "unknown", "versions": [ { "version": "< 1.3.1", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" }, { "id": "CWE-863", "name": "Incorrect Authorization" } ], "ssvc": { "exploitation": "none", "automatable": "no", "impact": "total", "at": "2026-10-13T15:14:24.356Z" }, "fix": "listed", "tags": [ "the-40-thieves", "npm" ], "cves": [ "CVE-2026-77366" ], "ghsa": "GHSA-84c9-qqpq-2pq5", "cvss": { "score": 9.9, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00308, "percentile": 0.22442, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "npm", "name": "obsidian-tc", "vulnerable": "< 1.3.1", "fixed": "1.3.1", "advisory": "GHSA-84c9-qqpq-2pq5" } ], "vendor": "The-40-Thieves", "product": "obsidian-tc", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-84c9-qqpq-2pq5" } ], "publishedAt": "2026-10-23T17:29:17.000Z", "updatedAt": "2026-10-23T17:29:17.000Z" } ], "tag": { "tag": "the-40-thieves", "name": "The-40-Thieves", "kev": null } }