Login Request a demo
MC
Product
mcp-atlassian
by sooperset · last CVE Sep 22, 2026
34
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities34In the news0Timeline
Severity mix
Critical 2High 18Medium 14Low 0
Severity
All severities34Critical2High18Medium14Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add mcp-atlassian to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-77256
6.5
0%
Sep 22
MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask
Affected: < 0.22.0
CVE-2026-77247
6.5
0%
Sep 22
MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters
Affected: < 0.22.0
CVE-2026-77269
6.5
0%
Sep 22
MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)
Affected: < 0.22.0
CVE-2026-77266
6.5
0%
Sep 22
MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call
Affected: < 0.22.0
CVE-2026-77257
6.5
0%
Sep 22
MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths
Affected: < 0.22.0
CVE-2026-77251
6.5
0%
Sep 22
MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)
Affected: < 0.22.0
CVE-2026-77252
6.5
0%
Sep 22
MCP Atlassian: JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER can be bypassed in search tools
Affected: < 0.22.0
CVE-2026-77267
6.5
0%
Sep 22
mcp-atlassian has an incomplete SSRF remediation
Affected: < 0.22.0
CVE-2026-77270
6.5
0%
Sep 22
MCP Atlassian: Arbitrary File Read via Upload Attachment Tools
Affected: < 0.22.0
CVE-2026-73497
6.5
0%
Sep 14
MCP Atlassian is a Model Context Protocol (MCP): DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826): unauthenticated SSRF to cloud metadata
Affected: >= 0.17.0, < 0.22.0
CVE-2026-77272
6.1
0%
Sep 22
MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler
Affected: < 0.22.0
CVE-2026-77250
6.1
0%
Sep 22
MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions
Affected: < 0.22.0
CVE-2026-77268
5.5
0%
Sep 22
MCP Atlassian: Insecure File Permissions on OAuth Token Storage
Affected: < 0.22.0
CVE-2026-77249
5.3
0%
Sep 22
MCP Atlassian: Incomplete fix for CVE-2026-27826: redirect-based SSRF via unhooked requests session in Jira user-permission lookup
Affected: < 0.22.0
Showing 14