CVE-2026-77363
HighCVSS 8.8Summary
A vulnerability in obsidian-tc, a Model Context Protocol server for Obsidian vaults, before version 1.3.1, does not validate Host or Origin headers or enable DNS-rebinding protection in the Streamable HTTP transport. With loopback configuration using auth.mode set to none, a malicious web page can send requests to the local MCP endpoint and gain unrestricted vault access via the http-local caller. Version 1.3.1 fixes the issue by enabling host, origin, and DNS-rebinding validation.
Risk Assessment
The risk includes unauthorized access to Obsidian vault data via malicious web pages, potentially leading to data exfiltration or manipulation.
Recommendation
Upgrade obsidian-tc to version 1.3.1 or later and enable authentication (auth.mode) in loopback configuration to prevent unauthorized access.
Other vulnerabilities in obsidian-tc
See all- CVE-2026-77364Medium
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only during enumeration. An authenticated caller can directly read sensitive files such as .obsidian/plugins/*/data.json.
- CVE-2026-77366Critical
In obsidian-tc prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JWT has no vault claim, and the folder access-control list is shared globally. Any valid token can therefore select another configured vault and read, write, or delete its contents through affected tools.
Original NVD description (English source)
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a malicious web page can send requests to the local MCP endpoint and receive unrestricted vault access through the http-local caller. Version 1.3.1 fixes the vulnerability by enabling host, origin, and DNS-rebinding validation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS