{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/data-corruption/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:obsidian-tc_project:obsidian-tc:*:*:*:*:*:node.js:*:*","cpe:2.3:a:obsidian-tc:obsidian-tc:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-77363"},{"cvss":9.9,"id":"CVE-2026-77366"},{"id":"CVE-2026-115478"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["obsidian-tc (\u003c 1.3.1)","obsidian-tc (\u003e= 1.0.1, \u003c= 1.31.3)"],"_cs_severities":["critical"],"_cs_tags":["auth-bypass","multi-tenancy","web-application","npm","vulnerability","file-overwrite","data-corruption"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe obsidian-tc HTTP transport implementation lacks \u003ccode\u003eenableDnsRebindingProtection\u003c/code\u003e, \u003ccode\u003eallowedHosts\u003c/code\u003e/\u003ccode\u003eallowedOrigins\u003c/code\u003e configurations, and does not perform \u003ccode\u003eOrigin\u003c/code\u003e-header validation. With the \u003ccode\u003eauth.mode: \u0026quot;none\u0026quot;\u003c/code\u003e loopback default, a malicious web page can perform a drive-by \u003ccode\u003ePOST\u003c/code\u003e request to \u003ccode\u003ehttp://127.0.0.1/mcp\u003c/code\u003e to obtain full vault read/write access.\u003c/p\u003e\n","date_modified":"2026-10-23T21:48:49Z","date_published":"2026-10-23T21:45:06Z","id":"https://feed.craftedsignal.io/briefs/2026-10-obsidian-tc-vulnerability/","summary":"The obsidian-tc package HTTP transport lacks Origin header validation and DNS-rebinding protection, allowing drive-by vault access via loopback.","title":"obsidian-tc: Remote vault access via HTTP transport (CVE-2026-77363)","url":"https://feed.craftedsignal.io/briefs/2026-10-obsidian-tc-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Data-Corruption","version":"https://jsonfeed.org/version/1.1"}