The server could listen on a loopback address while accepting MCP requests with auth.mode set to none. In the affected transport, missing origin validation and DNS-rebinding protection allowed a malicious page, under appropriate browser and DNS conditions, to interact with the locally running endpoint. The local identity carried wildcard scopes, giving…
Inspect the ClaimsCase · DiggingBeagle record
Obsidian-TC localhost MCP transport lacked web-origin validation
The unauthenticated loopback Streamable HTTP mode did not check Origin or enforce DNS-rebinding restrictions, enabling browser-mediated tool access under the affected configuration.
Scope
Evidence-bound research; no independent field exploitation, victim population or production impact is asserted beyond the cited source.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The maintainer reports a vulnerable loopback Streamable HTTP configuration with no authentication and missing Host/Origin protections; the first published fixed release is 1.3.1. Impact remains ungraded because a comparable, verified realized-loss or deployment-population measure is unavailable.
Assessed Oct 14, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP6-OBSIDIAN-ORIGIN-1 · CLM-CP6-OBSIDIAN-ORIGIN-2 · Obsidian-TC local HTTP origin and DNS-rebinding advisory GHSA-pqh8-4pj7-32xx
At a glance
No production drive-by compromise or browser-vendor-specific exploitation rate is established.
Limits and uncertaintyFull account
The server could listen on a loopback address while accepting MCP requests with auth.mode set to none. In the affected transport, missing origin validation and DNS-rebinding protection allowed a malicious page, under appropriate browser and DNS conditions, to interact with the locally running endpoint. The local identity carried wildcard scopes, giving browser-initiated requests the same vault tool reach as a trusted local caller.
Version 1.3.1 adds allowed host and origin checks, enables rebinding protection and responds with 403 for an invalid origin. The GitHub advisory was published July 3. The issue does not mean an external network host could connect directly to every loopback-only installation.
Binding a service to localhost does not itself authenticate the webpage that caused a browser to contact it. In the documented auth.mode none configuration, a browser-origin request could be promoted to an http-local principal with wildcard scopes if the Host and Origin trust boundary was not enforced. The revised transport checks accepted hosts and origins and rejects invalid origins with HTTP 403. This remedy changes browser-mediated reachability; it does not replace vault-specific authorization for callers who legitimately hold credentials.
Timeline
- Jul 3, 2026disclosure
Public disclosure
Claims & evidence
CLM-CP6-OBSIDIAN-ORIGIN-1The pre-1.3.1 Obsidian-TC Streamable HTTP server lacked explicit Origin checks and DNS-rebinding protection, enabling browser-origin access in the documented unauthenticated local configuration.supported
Basis: reported finding
- supportsObsidian-TC local HTTP origin and DNS-rebinding advisory GHSA-pqh8-4pj7-32xxprimary disclosure
Impact; auth.mode none and http-local wildcard scopes
CLM-CP6-OBSIDIAN-ORIGIN-2The maintainer lists 1.3.1 as patched, adding allowed host/origin validation and HTTP 403 on invalid Origin.supported
Basis: reported finding
- supportsObsidian-TC local HTTP origin and DNS-rebinding advisory GHSA-pqh8-4pj7-32xxprimary disclosure
Patches; upgrade to >= 1.3.1
Controls and mitigations
- Require authentication for local HTTP MCP access and validate allowed origins/hosts; upgrade to 1.3.1 or later.
Unknowns and contradictions
- No production drive-by compromise or browser-vendor-specific exploitation rate is established.
Sources and citation
Material revision history
- Oct 14, 2026 · Canonical change recorded · new in release · revision 147