obsidian-tc: two critical flaws let tokens reach any vault and drive-by pages access loopback server (CVE-2026-77366, CVE-2026-77363)
Severity: critical · Patch status: patched · Since 2026-07-03 · CVE-2026-77363, CVE-2026-77366
Two critical advisories were published for the obsidian-tc npm package (MCP server for Obsidian vaults). First, tool dispatch never checked the caller-supplied input.vault against the caller's bound vault (ctx.vaultId); the folder ACL was a single global instance and JWTs carried no vault claim, so any valid token could read, write, or delete any configured vault across ~90 tool sites, defeating multi-tenant isolation (CVE-2026-77366, CVSS 9.9). Second, the Streamable HTTP transport lacked Origin validation and DNS-rebinding protection; with the documented auth.mode "none" loopback default, a malicious web page could POST to http://127.0.0.1/mcp and receive full vault read/write access via DNS rebinding (CVE-2026-77363, CVSS 9.6). Both fixed in 1.3.1; no exploitation reported.
What to do
- Upgrade obsidian-tc to >= 1.3.1 immediately
- Until upgraded, run a single vault per server process or isolate each tenant on a separate process/credential
- Do not expose the HTTP transport with auth.mode "none"; require JWT auth or bind behind a proxy validating Origin headers
Fixed versions
Sources
All live incidents on Threat Watch