MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions

🗓️ 01 Oct 2026 16:38:36Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 2 Views

MCP Atlassian writes plaintext OAuth tokens with group-readable permissions.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2026-77250	22 Sep 202622:35	–	circl
CVE	CVE-2026-77250	22 Sep 202617:51	–	cve
Cvelist	CVE-2026-77250 MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions	22 Sep 202617:51	–	cvelist
EUVD	EUVD-2026-84619	22 Sep 202617:51	–	euvd
Github Security Blog	MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions	22 Sep 202620:36	–	github
NVD	CVE-2026-77250	22 Sep 202618:17	–	nvd
OSV	GHSA-G5XV-MHGM-V5F6 MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions	22 Sep 202620:36	–	osv
OSV	PYSEC-2026-4094 MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions	1 Oct 202616:38	–	osv
Positive Technologies	PT-2026-96925	22 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-77250: Cleartext Storage of Sensitive Information	22 Sep 202600:00	–	rapid7

Vulners

Node

Source	Link
github	www.github.com/sooperset/mcp-atlassian/security/advisories/GHSA-g5xv-mhgm-v5f6
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-77250
github	www.github.com/sooperset/mcp-atlassian/pull/1448
github	www.github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460
github	www.github.com/sooperset/mcp-atlassian
github	www.github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0
pypi	www.pypi.org/project/mcp-atlassian
github	www.github.com/advisories/GHSA-g5xv-mhgm-v5f6

01 Oct 2026 17:10Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.1

EPSS0.00108

SSVC