Cpe:2.3:a:obsidian-Tc:obsidian-Tc:*:*:*:*:*:node.js:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aobsidian-tcobsidian-tcnode.js/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 21:45:06 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgobsidian-tc: Remote vault access via HTTP transport (CVE-2026-77363)https://feed.craftedsignal.io/briefs/2026-10-obsidian-tc-vulnerability/Fri, 23 Oct 2026 21:45:06 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-obsidian-tc-vulnerability/The obsidian-tc package HTTP transport lacks Origin header validation and DNS-rebinding protection, allowing drive-by vault access via loopback.The obsidian-tc HTTP transport implementation lacks enableDnsRebindingProtection, allowedHosts/allowedOrigins configurations, and does not perform Origin-header validation. With the auth.mode: "none" loopback default, a malicious web page can perform a drive-by POST request to http://127.0.0.1/mcp to obtain full vault read/write access.

]]>criticaladvisoryauth-bypassmulti-tenancyweb-applicationnpmvulnerabilityfile-overwritedata-corruption