{"id":"CVE-2026-77363","kind":"vulnerability","aliases":["CVE-2026-77363","GHSA-pqh8-4pj7-32xx"],"related":[],"title":"obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback","description":"### Impact\nThe Streamable HTTP transport was constructed without `enableDnsRebindingProtection`/`allowedHosts`/`allowedOrigins` and performed no `Origin`-header validation. With the documented `auth.mode: \"none\"` loopback default, a **drive-by web page could `POST http://127.0.0.1/mcp`** and receive caller `http-local` with scopes `[\"*\"]` — full vault read/write — via DNS rebinding / a forged Origin.\n\n### Patches\nFixed in **1.3.1**. Upgrade to `>= 1.3.1`. The transport now enables DNS-rebinding protection and allowed hosts/origins and returns HTTP 403 on an invalid Origin (per MCP 2025-11-25).\n\n### Workarounds\nDo not expose the HTTP transport with `auth.mode: \"none\"`; require JWT auth, or bind to a non-loopback interface behind a proxy that validates `Origin`.","summary":"The obsidian-tc HTTP MCP transport did not validate Origin headers or guard against DNS rebinding, so a web page open in the browser could reach it on loopback. An attacker in that page gets caller scope \"*\", which means full read and write access to the Obsidian vault when auth mode is none.","severity":"critical","cvss":9.600000381469727,"epss":0.0015699999639764428,"exploited":false,"exploited_at":null,"products":[{"name":"obsidian-tc","fixed":["1.3.1"],"affected":"< 1.3.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-tooling","claude-code","cwe-1385","cwe-346","local-dev","mcp","npm","obsidian","obsidian-tc"],"not_affected_if":["jwt-auth","patched-1.3.1"],"how_to_check":"Run npm ls obsidian-tc and confirm the installed version is 1.3.1 or later. Check whether the HTTP transport is set to auth.mode \"none\"; if it is, the install is exposed.","fix":"Upgrade obsidian-tc to 1.3.1 or later. Until then, require JWT auth for the HTTP transport instead of auth.mode \"none\".","status":"open","published_at":"2026-10-12T18:17:23+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T20:55:08+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-10-23T20:55:08Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade obsidian-tc to 1.3.1 or later. Until then, require JWT auth for the HTTP transport instead of auth.mode \"none\".","reach":"local","impact":"high","summary":"The obsidian-tc HTTP MCP transport did not validate Origin headers or guard against DNS rebinding, so a web page open in the browser could reach it on loopback. An attacker in that page gets caller scope \"*\", which means full read and write access to the Obsidian vault when auth mode is none.","category":"ai-tooling","who_cares":["obsidian-tc","claude-code","mcp","obsidian","local-dev"],"confidence":0.85,"needs_auth":"no","worst_case":"Drive-by web page reads and writes the entire Obsidian vault","analyst_note":"","how_to_check":"Run npm ls obsidian-tc and confirm the installed version is 1.3.1 or later. Check whether the HTTP transport is set to auth.mode \"none\"; if it is, the install is exposed.","needs_analyst":false,"not_affected_if":["jwt-auth","patched-1.3.1"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.00102,"input_tokens":3118,"output_tokens":1417,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-11':184C '-1385':38B '-2026':18A,26A '-25':185C '-346':40B '-77363':19A,27A '/mcp':137C '1.3.1':158C,161C '127.0.0.1':136C '2025':183C '32xx':24A '403':176C '4pj7':23A 'access':14A,94B 'ai':32B 'ai-tool':31B 'allow':171C 'allowedhost':113C 'allowedorigin':114C 'attack':81B 'auth':100B,198C 'auth.mode':124C,194C 'behind':207C 'bind':200C 'browser':74B 'caller':86B,140C 'claud':35B 'claude-cod':34B 'code':36B 'construct':110C 'could':75B,134C 'cve':17A,25A 'cwe':37B,39B 'default':127C 'dev':43B 'dns':65B,150C,167C 'dns-rebind':166C 'document':123C 'drive':11A,130C 'drive-bi':10A,129C 'enabl':9A,165C 'enablednsrebindingprotect':112C 'expos':189C 'fix':156C 'forg':153C 'full':90B,146C 'get':85B 'ghsa':21A 'ghsa-pqh8-4pj7-32xx':20A 'guard':63B 'header':61B,119C 'hosts/origins':172C 'http':4A,54B,107C,142C,175C,191C 'http-local':141C 'impact':104C 'interfac':206C 'invalid':179C 'jwt':197C 'lack':6A 'local':42B,143C 'local-dev':41B 'loopback':16A,79B,126C,205C 'mcp':44B,55B,182C 'mean':89B 'mode':101B 'non':204C 'non-loopback':203C 'none':103B,125C,195C 'npm':45B 'obsidian':2A,29A,46B,48B,52B,97B 'obsidian-tc':1A,28A,47B,51B 'open':71B 'origin':60B,118C,154C,180C,212C 'origin/dns-rebinding':7A 'page':70B,84B,133C 'patch':155C 'per':181C 'perform':116C 'post':135C 'pqh8':22A 'protect':8A,169C 'proxi':209C 'reach':76B 'read':91B 'read/write':148C 'rebind':66B,151C,168C 'receiv':139C 'requir':196C 'return':174C 'scope':87B,145C 'streamabl':106C 'tc':3A,30A,49B,53B 'tool':33B 'transport':5A,56B,108C,163C,192C 'upgrad':159C 'valid':59B,120C,211C 'vault':13A,98B,147C 'via':149C 'web':69B,132C 'without':111C 'workaround':186C 'write':93B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-12T18:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-pqh8-4pj7-32xx","url":"https://github.com/advisories/GHSA-pqh8-4pj7-32xx","severity":"critical","published_at":"2026-10-23T18:29:02+00:00","modified_at":"2026-10-23T18:29:05+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-77363","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77363","severity":null,"published_at":"2026-10-12T18:17:23+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}