CVE-2026-77363
Mở trang đầy đủCVSS 9.6 CRITICAL
obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback
Mô tả
Impact
The Streamable HTTP transport was constructed without enableDnsRebindingProtection/allowedHosts/allowedOrigins and performed no Origin-header validation. With the documented auth.mode: "none" loopback default, a drive-by web page could POST http://127.0.0.1/mcp and receive caller http-local with scopes ["*"] — full vault read/write — via DNS rebinding / a forged Origin.
Patches
Fixed in 1.3.1. Upgrade to >= 1.3.1. The transport now enables DNS-rebinding protection and allowed hosts/origins and returns HTTP 403 on an invalid Origin (per MCP 2025-11-25).
Workarounds
Do not expose the HTTP transport with auth.mode: "none"; require JWT auth, or bind to a non-loopback interface behind a proxy that validates Origin.
Điểm và phân loại
- CVSS
- 9.6 CRITICAL v3.1
- Nguồn điểm
- GitHub Advisory
- Mức độ (theo nguồn)
- CRITICAL
- EPSS
- 0.16%
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Ảnh hưởng
| Package | Bản bị ảnh hưởng | Bản đã sửa |
|---|---|---|
npm obsidian-tc |
< 1.3.1 |
1.3.1
|
Vì sao được giữ
- CVSS 9.6 >= 8.0
Loại tác động
Không nhận ra loại tác động nào từ CWE, vector hay mô tả.
Tham khảo
- https://github.com/advisories/GHSA-pqh8-4pj7-32xx
- https://github.com/The-40-Thieves/obsidian-tc/security/advisories/GHSA-pqh8-4pj7-32xx
- https://github.com/The-40-Thieves/obsidian-tc/pull/74
- https://github.com/The-40-Thieves/obsidian-tc/commit/6428bfe6fdfd43aa7b4b369be3aecd6a268fb928
- https://github.com/The-40-Thieves/obsidian-tc/releases/tag/v1.3.1
- https://nvd.nist.gov/vuln/detail/cve-2026-77363