AdvisoriesToolsStatsChecklistSubmitGet the email
← All advisories
CVE-2026-77363highBroken access control2026-10-12

CVE-2026-77363: obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Ho

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection.

01.

What it is

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a malicious web page can send requests to the local MCP endpoint and receive unrestricted vault access through the http-local caller. Version 1.3.1 fixes the vulnerability by enabling host, origin, and DNS-rebinding validation.

02.

How to check

  1. Compare your installed version with the range above (command below).
03.

How to fix

    04.

    Sources

    More advisories for this tool
    The weekly email

    One email a week. Only what changed.

    Every new security hole in AI coding tools, MCP servers, app builders and the stacks they generate (Next.js, Supabase, Node, PHP), each with how to check your app and the fix. No roundups of things you already read.

    Free, one email a week. Read the latest issue first if you like. One-click unsubscribe in every email. We never sell or share addresses.