{"id":"EUVD-2026-97733","enisaUuid":"76de43ca-ba21-3dcf-9381-1dc75316c6fa","description":"obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a malicious web page can send requests to the local MCP endpoint and receive unrestricted vault access through the http-local caller. Version 1.3.1 fixes the vulnerability by enabling host, origin, and DNS-rebinding validation.","datePublished":"Oct 12, 2026, 5:45:57 PM","dateUpdated":"Oct 13, 2026, 4:03:13 PM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","references":"https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-pqh8-4pj7-32xx\nhttps://github.com/The-40-Thieves/obsidian-tc/pull/74\nhttps://github.com/The-40-Thieves/obsidian-tc/commit/6428bfe6fdfd43aa7b4b369be3aecd6a268fb928\nhttps://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1\n","aliases":"CVE-2026-77363\nGHSA-pqh8-4pj7-32xx\n","assigner":"GitHub_M","epss":0.16,"enisaIdProduct":[{"id":"25ea38e2-a23a-35fa-91fb-41d703259365","product":{"name":"obsidian-tc","vendor":{"name":"The-40-Thieves"}},"product_version":"\u003c 1.3.1"}],"enisaIdVendor":[{"id":"9ab72d74-3f8c-3391-899b-2fada578f469","vendor":{"name":"The-40-Thieves"}}],"enisaIdVulnerability":[{"id":"ad16e5ad-8649-3960-bf6e-c7db60e657e7","vulnerability":{"id":"CVE-2026-77363","description":"obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a malicious web page can send requests to the local MCP endpoint and receive unrestricted vault access through the http-local caller. Version 1.3.1 fixes the vulnerability by enabling host, origin, and DNS-rebinding validation.","datePublished":"Oct 12, 2026, 5:45:57 PM","dateUpdated":"Oct 13, 2026, 4:03:13 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","references":"https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-pqh8-4pj7-32xx\nhttps://github.com/The-40-Thieves/obsidian-tc/pull/74\nhttps://github.com/The-40-Thieves/obsidian-tc/commit/6428bfe6fdfd43aa7b4b369be3aecd6a268fb928\nhttps://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1\n","enisa_id":"EUVD-2026-97733\n","assigner":"GitHub_M","epss":0.16,"dataProcessed":"Nov 7, 2026, 7:19:31 AM","vulnerabilityProduct":[{"id":"991345c0-75b6-389e-80c7-11d86a66e548","product":{"name":"obsidian-tc","vendor":{"name":"The-40-Thieves"}},"product_version":"\u003c 1.3.1"}],"vulnerabilityVendor":[{"id":"5348a531-3d12-3ed8-b896-f3d89507f14f","vendor":{"name":"The-40-Thieves"}}]}},{"id":"c1ba42b2-3142-3451-a280-eb428760b227","vulnerability":{"id":"GHSA-pqh8-4pj7-32xx","description":"obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback","datePublished":"Oct 23, 2026, 6:29:02 PM","dateUpdated":"Oct 23, 2026, 6:29:02 PM","baseScore":0.0,"references":"https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-pqh8-4pj7-32xx\nhttps://github.com/The-40-Thieves/obsidian-tc/pull/74\nhttps://github.com/The-40-Thieves/obsidian-tc/commit/6428bfe6fdfd43aa7b4b369be3aecd6a268fb928\nhttps://github.com/The-40-Thieves/obsidian-tc\nhttps://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1\nhttps://nvd.nist.gov/vuln/detail/cve-2026-77363\n","enisa_id":"EUVD-2026-97733\n","aliases":"CVE-2026-77363\nGHSA-pqh8-4pj7-32xx\n","epss":0.0,"dataProcessed":"Nov 7, 2026, 7:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}