obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback
Impact
The Streamable HTTP transport was constructed without enableDnsRebindingProtection/allowedHosts/allowedOrigins and performed no Origin-header validation. With the documented auth.mode: "none" loopback default, a drive-by web page could POST http://127.0.0.1/mcp and receive caller http-local with scopes ["*"] — full vault read/write — via DNS rebinding / a forged Origin.
Patches
Fixed in 1.3.1. Upgrade to >= 1.3.1. The transport now enables DNS-rebinding protection and allowed hosts/origins and returns HTTP 403 on an invalid Origin (per MCP 2025-11-25).
Workarounds
Do not expose the HTTP transport with auth.mode: "none"; require JWT auth, or bind to a non-loopback interface behind a proxy that validates Origin.
What to do
Upgrade to >= 1.3.1 (fixed in 1.3.1). Alternatively, do not expose the HTTP transport with auth.mode: "none"; require JWT auth, or bind to a non-loopback interface behind a proxy that validates Origin.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | obsidian-tc | < 1.3.1 | 1.3.1 |
References
- https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-pqh8-4pj7-32xx
- https://github.com/The-40-Thieves/obsidian-tc/pull/74
- https://github.com/The-40-Thieves/obsidian-tc/commit/6428bfe6fdfd43aa7b4b369be3aecd6a268fb928
- https://github.com/The-40-Thieves/obsidian-tc
- https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1
- https://nvd.nist.gov/vuln/detail/cve-2026-77363
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H- Weakness (CWE)
CWE-1385, CWE-346- Platform
- npm
- Package
obsidian-tc- Disclosed
- 23.10.2026
- Updated
- 24.10.2026 00:00
Sources and licenses · Edited or translated by DockRay; source rights and applicable licenses are retained.
OSV / GitHub Advisory Database - GHSA-pqh8-4pj7-32xx - CC BY 4.0
Vulnerability history: obsidian-tc
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 10.2026 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- Medium 3
Disclosures per year
- 2026: 5
-
obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.