Skip to content
Threat Feed
Subscribe
critical advisory

obsidian-tc: Remote vault access via HTTP transport (CVE-2026-77363)

The obsidian-tc package HTTP transport lacks Origin header validation and DNS-rebinding protection, allowing drive-by vault access via loopback.

CVE search metadata

CVE search record: CVE-2026-77363. Severity: high. CVSS: 8.8. EPSS: 0.16%. KEV: no. Product: obsidian-tc (< 1.3.1), obsidian-tc (>= 1.0.1, <= 1.31.3). Brief: obsidian-tc: Remote vault access via HTTP transport (CVE-2026-77363). Brief link: https://feed.craftedsignal.io/briefs/2026-10-obsidian-tc-vulnerability/

CVE search record: CVE-2026-77366. Severity: critical. CVSS: 9.9. EPSS: 0.31%. KEV: no. Product: obsidian-tc (< 1.3.1), obsidian-tc (>= 1.0.1, <= 1.31.3). Brief: obsidian-tc: Remote vault access via HTTP transport (CVE-2026-77363). Brief link: https://feed.craftedsignal.io/briefs/2026-10-obsidian-tc-vulnerability/

CVE search record: CVE-2026-115478. KEV: no. Product: obsidian-tc (< 1.3.1), obsidian-tc (>= 1.0.1, <= 1.31.3). Brief: obsidian-tc: Remote vault access via HTTP transport (CVE-2026-77363). Brief link: https://feed.craftedsignal.io/briefs/2026-10-obsidian-tc-vulnerability/

Triage facts

Revision 2
Applicability
obsidian-tc (< 1.3.1), obsidian-tc (>= 1.0.1, <= 1.31.3)
Evidence
Unknown
Severity
Critical
Action
Immediate escalation
Sources
5 public sources
Freshness
Revision 2Oct 23, 21:50 UTC
Vulnerabilities
3 CVEs
Source quality
B2Roughly even chance
Revision history 1 entry · Revision 2
  1. Revision 2

    added coverage for obsidian-tc (>= 1.0.1, <= 1.31.3)

    Changed: action_plan, affected_products, cpes, cves, lastmod, qa_status, references, tags, updates

    Sources: 1

The obsidian-tc HTTP transport implementation lacks enableDnsRebindingProtection, allowedHosts/allowedOrigins configurations, and does not perform Origin-header validation. With the auth.mode: "none" loopback default, a malicious web page can perform a drive-by POST request to http://127.0.0.1/mcp to obtain full vault read/write access.

Immediate actions

Upgrade obsidian-tc to 1.3.1 or higher

IT Operations 24h

Upgrade npm/obsidian-tc to 1.31.4

IT Operations 24h

Threat Hunt

Identify authenticated sessions performing operations across multiple vault IDs

high high confidence hunt now

Data: Application logs containing caller-supplied vault parameters and associated session context

Identify rapid modification or deletion of Markdown files within the vault directory by the process hosting obsidian-tc

medium medium confidence hunt now

Data: File system audit logs (e.g., auditd, Sysmon Event ID 11)

Mitigations

Run each vault on a separate process or isolate via distinct credentials

immediate IT Operations

CVE-2026-77366

Revoke memory-write scope for callers

immediate IT Operations

CVE-2026-115478