Skip to content
Threat Feed
Subscribe

Product

Obsidian-Tc (>= 1.0.1, <= 1.31.3)

1 brief RSS
critical advisory

obsidian-tc: Remote vault access via HTTP transport (CVE-2026-77363)

The obsidian-tc package HTTP transport lacks Origin header validation and DNS-rebinding protection, allowing drive-by vault access via loopback.

obsidian-tc +1 auth-bypass multi-tenancy web-application npm vulnerability file-overwrite data-corruption
3c