Vulnerability in Obsidian-tc Model Context Protocol Server Exposes Local MCP Endpoint
CVE-2026-77363

8.8HIGH

Key Information:

Vendor

The-40-thieves

Status
Obsidian-tc
Vendor
CVE Published:
12 October 2026

What is CVE-2026-77363?

The obidian-tc is an agent-ready Model Context Protocol server designed for Obsidian vaults. A flaw existed in versions before 1.3.1, where the Streamable HTTP transport did not properly validate the Host or Origin headers, and lacked DNS-rebinding protection. Without the proper authentication mode, a malicious web page could exploit this vulnerability, sending requests to the local MCP endpoint and thus gaining unrestricted access to the vault. The issue was addressed in version 1.3.1, which introduced essential validations to safeguard against such attacks.

Affected Version(s)

obsidian-tc < 1.3.1

References

https://github.com/The-40-Thieves/obsidian-tc/security/ad...
x_refsource_CONFIRM
https://github.com/The-40-Thieves/obsidian-tc/pull/74
x_refsource_MISC
https://github.com/The-40-Thieves/obsidian-tc/commit/6428...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.