CVE-2026-77363 Details
Description
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a malicious web page can send requests to the local MCP endpoint and receive unrestricted vault access through the http-local caller. Version 1.3.1 fixes the vulnerability by enabling host, origin, and DNS-rebinding validation.
A vulnerability in the Streamable HTTP transport of Obsidian-TC, a Model Context Protocol server for Obsidian vaults, prior to version 1.3.1, allows for unauthorized access to vaults. The issue arises because the HTTP transport does not validate the Host or Origin headers and lacks protection against DNS rebinding. When the authentication mode is set to 'none', a malicious web page can send requests to the local MCP endpoint, exploiting these vulnerabilities to gain unrestricted access to the user's vault through the http-local caller.
Users can upgrade to Obsidian-TC version 1.3.1 or later, which addresses this vulnerability by implementing DNS-rebinding protection, validating Origin and Host headers, and allowing configuration of accepted hosts and origins.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/The-40-Thieves/obsidian-tc/commit/6428bfe6fdfd43aa7b4b369be3aecd6a268fb928 | [email protected] | Source CodeVendor |
| https://github.com/The-40-Thieves/obsidian-tc/pull/74 | [email protected] | Source CodeVendor |
| https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1 | [email protected] | Release NotesVendor |
| https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-pqh8-4pj7-32xx | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1385 | Missing Origin Validation in WebSockets | [email protected] |
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| The-40-Thieves obsidian-tc | < 1.3.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |