GHSA-pqh8-4pj7-32xx
obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback
At a glance
- Published
- Updated
- CVE
- CVE-2026-77363
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Description
### Impact The Streamable HTTP transport was constructed without `enableDnsRebindingProtection`/`allowedHosts`/`allowedOrigins` and performed no `Origin`-header validation. With the documented `auth.mode: "none"` loopback default, a **drive-by web page could `POST http://127.0.0.1/mcp`** and receive caller `http-local` with scopes `["*"]` — full vault read/write — via DNS rebinding / a forged Origin. ### Patches Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. The transport now enables DNS-rebinding protection and allowed hosts/origins and returns HTTP 403 on an invalid Origin (per MCP 2025-11-25). ### Workarounds Do not expose the HTTP transport with `auth.mode: "none"`; require JWT auth, or bind to a non-loopback interface behind a proxy that validates `Origin`.
Affected packages
| Package | Versions |
|---|---|
| npm · obsidian-tc | introduced 0, fixed 1.3.1 |
References
- https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-pqh8-4pj7-32xx WEB
- https://github.com/The-40-Thieves/obsidian-tc/pull/74 WEB
- https://github.com/The-40-Thieves/obsidian-tc/commit/6428bfe6fdfd43aa7b4b369be3aecd6a268fb928 WEB
- https://github.com/The-40-Thieves/obsidian-tc PACKAGE
- https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1 WEB
- https://nvd.nist.gov/vuln/detail/cve-2026-77363 ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |