Mcp-atlassian

Records30All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high19CVSS 7.0–8.9

Exploited now

Mcp-atlassian records in CISA KEV

No Mcp-atlassian vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Mcp Atlassian 30 records HIGH

Records

30 records

TI-2026-53938 CVE-2026-77254

MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials

HIGH 80

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0062 Published 2026-09-22 Fixed in 0.22.0 CWE-306

TI-2026-53957 CVE-2026-77274 · GHSA-hgcf-4mq8-5266

MCP Atlassian: SSRF Protection Bypass

HIGH 77

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0033 Published 2026-09-22 Fixed in 0.22.0 CWE-918

TI-2026-53935 CVE-2026-77251 · GHSA-w66g-j6c4-hcfc

Protection mechanism failure in sooperset mcp-atlassian

HIGH 77

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00266 Published 2026-09-22 Fixed in 0.22.0 CWE-1276

TI-2026-53946 CVE-2026-77262 · GHSA-p6hp-93wp-fh6p

Path traversal in sooperset mcp-atlassian

HIGH 76

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00557 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-53932 CVE-2026-77248 · GHSA-cc5h-2pwp-pvcc

Path traversal in sooperset mcp-atlassian

HIGH 76

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00475 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-22177 CVE-2026-27825 · GHSA-xjgw-4wvw-rgm4

Path traversal in sooperset mcp-atlassian

HIGH 74

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1CRITICAL 9.1 Adjacent network Low privileges No interaction EPSS 0.12254 Published 2026-03-10 Fixed in 0.17.0 CWE-22

TI-2026-53928 CVE-2026-77243 · GHSA-3r68-hf9h-887v

MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

HIGH 73

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00544 Published 2026-09-22 Fixed in 0.22.0 CWE-862

TI-2026-53944 CVE-2026-77260 · GHSA-f4p7-qx46-wc5j

MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)

HIGH 71

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00385 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-53939 CVE-2026-77255 · GHSA-2xj6-xx86-cwwc

MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

HIGH 70

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00459 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-53930 CVE-2026-77246 · GHSA-wv8v-v4c5-v75j

MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

HIGH 70

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00471 Published 2026-09-22 Fixed in 0.22.0 CWE-200

TI-2026-53955 CVE-2026-77271 · GHSA-6vmq-24h2-pj7j

MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)

HIGH 69

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00596 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-53951 CVE-2026-77267 · GHSA-5wf4-jqxh-8gm3

mcp-atlassian has an incomplete SSRF remediation

HIGH 69

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.0032 Published 2026-09-22 Fixed in 0.22.0 CWE-918

TI-2026-53940 CVE-2026-77256

MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask

HIGH 69

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00347 Published 2026-09-22 Fixed in 0.22.0 CWE-732

TI-2026-53931 CVE-2026-77247 · GHSA-f6pj-qv47-g96w

MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

HIGH 69

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00388 Published 2026-09-22 Fixed in 0.22.0 CWE-73

TI-2026-53943 CVE-2026-77259 · GHSA-6cr4-ccf3-x7h4

MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

HIGH 67

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00442 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-53942 CVE-2026-77258 · GHSA-93xw-j965-9mx3

MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()

HIGH 67

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00374 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-53949 CVE-2026-77265 · GHSA-49xv-9743-pw8w

MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow

HIGH 66

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00291 Published 2026-09-22 Fixed in 0.22.0 CWE-918

TI-2026-53927 CVE-2026-77242

MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned)

HIGH 66

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.003 Published 2026-09-22 Fixed in 0.22.0 CWE-367

TI-2026-53937 CVE-2026-77253 · GHSA-vc25-24vv-fxxm

MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

MEDIUM 64

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00444 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-53954 CVE-2026-77270 · GHSA-f26r-j276-ggg4

MCP Atlassian: Arbitrary File Read via Upload Attachment Tools

MEDIUM 62

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.005 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-53953 CVE-2026-77269 · GHSA-h7wj-5v37-59r2

MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)

MEDIUM 62

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0043 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-53950 CVE-2026-77266 · GHSA-mfv2-4wvm-9pgp

MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call

MEDIUM 62

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.005 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-53934 CVE-2026-77250 · GHSA-g5xv-mhgm-v5f6

MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions

MEDIUM 60

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1MEDIUM 6.1 Local Low privileges No interaction EPSS 0.00115 Published 2026-09-22 Fixed in 0.22.0 CWE-312

TI-2026-53929 CVE-2026-77244 · GHSA-wrhw-j3f9-8vc6

[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

MEDIUM 49

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00346 Published 2026-09-22 Fixed in 0.22.0 CWE-287

TI-2026-53945 CVE-2026-77261 · GHSA-6529-c226-h328

MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches

LOW 37

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00373 Published 2026-09-22 Fixed in 0.22.0 CWE-918

Open these records in search →