Evidence · DiggingBeagle record
Obsidian-TC local HTTP origin and DNS-rebinding advisory GHSA-pqh8-4pj7-32xx
Maintainer advisory describing origin validation gap in Streamable HTTP when unauthenticated loopback access has wildcard tool scope.
- Published
- Jul 3, 2026
- Source role
- primary disclosure
Evidence record
Maintainer advisory describing origin validation gap in Streamable HTTP when unauthenticated loopback access has wildcard tool scope.
Claim-level citations (2)
- supportsObsidian-TC localhost MCP transport lacked web-origin validation: The pre-1.3.1 Obsidian-TC Streamable HTTP server lacked explicit Origin checks and DNS-rebinding protection, enabling browser-origin access in the documented unauthenticated local configuration.
Impact; auth.mode none and http-local wildcard scopes
- supportsObsidian-TC localhost MCP transport lacked web-origin validation: The maintainer lists 1.3.1 as patched, adding allowed host/origin validation and HTTP 403 on invalid Origin.
Patches; upgrade to >= 1.3.1