~ / search / GHSA-pqh8-4pj7-32xx

GHSA-pqh8-4pj7-32xx

obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-77363

Packages

EcosystemPackageAffectedFixed in
npm obsidian-tc < 1.3.1 1.3.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The Streamable HTTP transport was constructed without `enableDnsRebindingProtection`/`allowedHosts`/`allowedOrigins` and performed no `Origin`-header validation. With the documented `auth.mode: "none"` loopback default, a **drive-by web page could `POST http://127.0.0.1/mcp`** and receive caller `http-local` with scopes `["*"]` — full vault read/write — via DNS rebinding / a forged Origin. ### Patches Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. The transport now enables DNS-rebinding protection and allowed hosts/origins and returns HTTP 403 on an invalid Origin (per MCP 2025-11-25). ### Workarounds Do not expose the HTTP transport with `auth.mode: "none"`; require JWT auth, or bind to a non-loopback interface behind a proxy that validates `Origin`.

References

External links from the advisory. They lead to third-party sites.