CVE-2026-77246

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, an HTTP transport deployment with READONLYMODE=false accepts a request without an Authorization identity and permits attacker-controlled Atlassian service headers, including...

CVE-2026-77246 MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, an HTTP transport deployment with READONLYMODE=false accepts a request without an Authorization identity and permits attacker-controlled Atlassian service headers, including...