---
id: "CVE-2026-77363"
kind: "vulnerability"
aliases: ["CVE-2026-77363", "GHSA-pqh8-4pj7-32xx"]
title: "obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback"
severity: "critical"
cvss: 9.600000381469727
epss: 0.0015699999639764428
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "obsidian-tc", "fixed": ["1.3.1"], "affected": "< 1.3.1", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["ai-tooling", "claude-code", "cwe-1385", "cwe-346", "local-dev", "mcp", "npm", "obsidian", "obsidian-tc"]
not_affected_if: ["jwt-auth", "patched-1.3.1"]
published_at: "2026-10-12T18:17:23+00:00"
first_seen_at: "2026-10-23T19:11:31+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-pqh8-4pj7-32xx", "first_seen_at": "2026-10-23T19:11:31+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77363", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

The obsidian-tc HTTP MCP transport did not validate Origin headers or guard against DNS rebinding, so a web page open in the browser could reach it on loopback. An attacker in that page gets caller scope "*", which means full read and write access to the Obsidian vault when auth mode is none.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:obsidian-tc affected < 1.3.1 fixed 1.3.1

## How to check

Run npm ls obsidian-tc and confirm the installed version is 1.3.1 or later. Check whether the HTTP transport is set to auth.mode "none"; if it is, the install is exposed.

## Fix

Upgrade obsidian-tc to 1.3.1 or later. Until then, require JWT auth for the HTTP transport instead of auth.mode "none".

## Timeline

- 2026-10-23T19:11:31+00:00 ghsa https://github.com/advisories/GHSA-pqh8-4pj7-32xx
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77363

## From the sources

### Impact
The Streamable HTTP transport was constructed without `enableDnsRebindingProtection`/`allowedHosts`/`allowedOrigins` and performed no `Origin`-header validation. With the documented `auth.mode: "none"` loopback default, a **drive-by web page could `POST http://127.0.0.1/mcp`** and receive caller `http-local` with scopes `["*"]` — full vault read/write — via DNS rebinding / a forged Origin.

### Patches
Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. The transport now enables DNS-rebinding protection and allowed hosts/origins and returns HTTP 403 on an invalid Origin (per MCP 2025-11-25).

### Workarounds
Do not expose the HTTP transport with `auth.mode: "none"`; require JWT auth, or bind to a non-loopback interface behind a proxy that validates `Origin`.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_