Vulnerabilities

TI-2026-53930 CVE-2026-77246 · GHSA-wv8v-v4c5-v75j

MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

HIGH 70

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00471 Published 2026-09-22 Fixed in 0.22.0 CWE-200

TI-2026-53932 CVE-2026-77248 · GHSA-cc5h-2pwp-pvcc

Path traversal in sooperset mcp-atlassian

HIGH 76

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00475 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-53940 CVE-2026-77256

MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask

HIGH 69

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00347 Published 2026-09-22 Fixed in 0.22.0 CWE-732

TI-2026-53933 CVE-2026-77249 · GHSA-v9m3-wfh8-5646

Server-side request forgery in sooperset mcp-atlassian

LOW 30

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00336 Published 2026-09-22 Fixed in 0.22.0 CWE-918

TI-2026-53943 CVE-2026-77259 · GHSA-6cr4-ccf3-x7h4

MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

HIGH 67

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00442 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-53952 CVE-2026-77268 · GHSA-4596-2p6p-28cv

MCP Atlassian: Insecure File Permissions on OAuth Token Storage

LOW 24

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00153 Published 2026-09-22 Fixed in 0.22.0 CWE-732

TI-2026-53931 CVE-2026-77247 · GHSA-f6pj-qv47-g96w

MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

HIGH 69

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00388 Published 2026-09-22 Fixed in 0.22.0 CWE-73

TI-2026-53956 CVE-2026-77272 · GHSA-g2r2-3j32-j27x

MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

LOW 27

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00262 Published 2026-09-22 Fixed in 0.22.0 CWE-79

TI-2026-53953 CVE-2026-77269 · GHSA-h7wj-5v37-59r2

MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)

MEDIUM 62

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0043 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-53950 CVE-2026-77266 · GHSA-mfv2-4wvm-9pgp

MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call

MEDIUM 62

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.005 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-53939 CVE-2026-77255 · GHSA-2xj6-xx86-cwwc

MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

HIGH 70

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00459 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-53946 CVE-2026-77262 · GHSA-p6hp-93wp-fh6p

Path traversal in sooperset mcp-atlassian

HIGH 76

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00557 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-53938 CVE-2026-77254

MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials

HIGH 80

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0062 Published 2026-09-22 Fixed in 0.22.0 CWE-306

TI-2026-53937 CVE-2026-77253 · GHSA-vc25-24vv-fxxm

MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

MEDIUM 64

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00444 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-53941 CVE-2026-77257 · GHSA-mrq8-fv7v-hhjg

MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths

LOW 36

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00386 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-53945 CVE-2026-77261 · GHSA-6529-c226-h328

MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches

LOW 37

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00373 Published 2026-09-22 Fixed in 0.22.0 CWE-918

TI-2026-53944 CVE-2026-77260 · GHSA-f4p7-qx46-wc5j

MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)

HIGH 71

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00385 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-53955 CVE-2026-77271 · GHSA-6vmq-24h2-pj7j

MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)

HIGH 69

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00596 Published 2026-09-22 Fixed in 0.22.0 CWE-22

TI-2026-53927 CVE-2026-77242

MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned)

HIGH 66

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.003 Published 2026-09-22 Fixed in 0.22.0 CWE-367

TI-2026-53928 CVE-2026-77243 · GHSA-3r68-hf9h-887v

MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

HIGH 73

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00544 Published 2026-09-22 Fixed in 0.22.0 CWE-862

TI-2026-53935 CVE-2026-77251 · GHSA-w66g-j6c4-hcfc

Protection mechanism failure in sooperset mcp-atlassian

HIGH 77

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00266 Published 2026-09-22 Fixed in 0.22.0 CWE-1276

TI-2026-53936 CVE-2026-77252

MCP Atlassian: JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER can be bypassed in search tools

LOW 29

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00298 Published 2026-09-22 Fixed in 0.22.0 CWE-284

TI-2026-53951 CVE-2026-77267 · GHSA-5wf4-jqxh-8gm3

mcp-atlassian has an incomplete SSRF remediation

HIGH 69

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.0032 Published 2026-09-22 Fixed in 0.22.0 CWE-918

TI-2026-53934 CVE-2026-77250 · GHSA-g5xv-mhgm-v5f6

MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions

MEDIUM 60

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1MEDIUM 6.1 Local Low privileges No interaction EPSS 0.00115 Published 2026-09-22 Fixed in 0.22.0 CWE-312

TI-2026-53929 CVE-2026-77244 · GHSA-wrhw-j3f9-8vc6

[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

MEDIUM 49

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00346 Published 2026-09-22 Fixed in 0.22.0 CWE-287

Vulnerabilities

Filters