obsidian-tc: Missing Host/Origin validation allows cross-origin access to vault
Summary
obsidian-tc is an npm MCP server that gives AI agents and MCP clients access to Obsidian vaults. Before version 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header, so a malicious web page visited in a browser on the same machine can send requests to the local MCP endpoint. If auth.mode is set to none, as in the documented loopback configuration, an attacker can read and modify all notes in the vault.
Affected
- obsidian-tc, all versions before 1.3.1
- Relevant only when the HTTP transport runs with auth.mode set to none (loopback configuration)
Fixed in
- Version 1.3.1 (enables Host, Origin and DNS-rebinding validation)
Workaround
- No vendor workaround documented; the vendor recommends upgrading.
- Do not run the HTTP transport with auth.mode set to none.
- Stop the server when it is not in use.
Exploitation
- CISA SSVC: exploitation none, not automatable.
- VulDB: no exploit available.
- No public proof of concept or known exploitation in the wild found.
- Attack requires user interaction (victim visits a malicious web page) but no credentials.
Our recommendation
- Inventory workstations with obsidian-tc installed and check the version.
- Upgrade to version 1.3.1 or later.
- Check whether auth.mode is set to none and change it if so.
- Review other advisories for the same package (GHSA-84c9-qqpq-2pq5, GHSA-737x-cwfr-5vvc) during the upgrade.
- Stop the server when it is not needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-pqh8-4pj7-32xx github.com
- Fix commit 6428bfe github.com
- Pull request #74 github.com
- Release v1.3.1 github.com
- VulDB entry 417146 vuldb.com
- OSV GHSA-pqh8-4pj7-32xx osv.dev
- GitLab advisory database entry advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:26.
Original description (NVD)
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a malicious web page can send requests to the local MCP endpoint and receive unrestricted vault access through the http-local caller. Version 1.3.1 fixes the vulnerability by enabling host, origin, and DNS-rebinding validation.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.