PYSEC-2026-4169 social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

Impact The LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victi...

MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)

SummaryThe confluenceuploadattachment and confluenceuploadattachments MCP tools accept a filepath parameter and do not validate that the path is confined to an allowed directory before opening the file. An attacker who can call these tools can read any file accessible to the MCP server process SS...

PYSEC-2026-4090 MCP Atlassian: Arbitrary File Read via Upload Attachment Tools

Summary The upload attachment tools in both Confluence and Jira accept arbitrary file paths without path traversal validation. The uploadattachment methods read any file accessible to the server process and upload it to a Confluence page or Jira issue. Despite the existence of a validatesafepath...

MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

SummaryThe OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser...

MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

SummaryA critical Confused Deputy Arbitrary File Read & Exfiltration vulnerability in the Atlassian MCP server Python allows an AI agent to exfiltrate sensitive host files and environment secrets. By providing absolute system paths to the attachments parameter of the updateissue tool, an agent ca...

PYSEC-2026-4091 MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)

Summary This is an arbitrary local file READ vulnerability on the Confluence and Jira uploadattachment tool paths. It's the symmetric counterpart of the file-write vulnerability you patched as CVE-2026-27825. The write direction was fixed; the read direction was left open. Reporter: Sean Valentin...

PYSEC-2026-4080 MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

Summary A critical Confused Deputy Arbitrary File Read & Exfiltration vulnerability in the Atlassian MCP server Python allows an AI agent to exfiltrate sensitive host files and environment secrets. By providing absolute system paths to the attachments parameter of the updateissue tool, an agent c...

MCP Atlassian: Arbitrary File Read via Upload Attachment Tools

SummaryThe upload attachment tools in both Confluence and Jira accept arbitrary file paths without path traversal validation. The uploadattachment methods read any file accessible to the server process and upload it to a Confluence page or Jira issue. Despite the existence of a validatesafepath...

MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call

SummaryThe uploadattachment functions in both the Jira and Confluence modules accept a user-controlled filepath parameter and open the specified file for reading without calling validatesafepath. An authenticated MCP client can supply an arbitrary path such as /etc/passwd or /proc/self/environ,...

MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)

SummaryThis is an arbitrary local file READ vulnerability on the Confluence and Jira uploadattachment tool paths. It's the symmetric counterpart of the file-write vulnerability you patched as CVE-2026-27825. The write direction was fixed; the read direction was left open.Reporter: Sean...

PYSEC-2026-4097 MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call

Summary The uploadattachment functions in both the Jira and Confluence modules accept a user-controlled filepath parameter and open the specified file for reading without calling validatesafepath. An authenticated MCP client can supply an arbitrary path such as /etc/passwd or /proc/self/environ,...

PYSEC-2026-4093 MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

Summary The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser...

PYSEC-2026-4095 MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)

Summary The confluenceuploadattachment and confluenceuploadattachments MCP tools accept a filepath parameter and do not validate that the path is confined to an allowed directory before opening the file. An attacker who can call these tools can read any file accessible to the MCP server process S...

PYSEC-2026-4104 MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

Summary The mcp-atlassian server exposes an MCP tool confluenceuploadattachment and the Jira attachment variant that accepts an arbitrary server-side file path and opens it for upload without any path validation. When the server is deployed in HTTP transport mode streamable-http or sse, a remote,...

MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

SummaryThe mcp-atlassian server exposes an MCP tool confluenceuploadattachment and the Jira attachment variant that accepts an arbitrary server-side file path and opens it for upload without any path validation. When the server is deployed in HTTP transport mode streamable-http or sse, a remote,...

PYSEC-2026-4178 vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

Summary Current vLLM main lets an inference request choose the PyNvVideoCodec GPU video decoder through mediaiokwargs.video.videobackend, but engine GPU memory reservation is computed only from static startup configuration and VLLMVIDEOLOADERBACKEND. If the server starts with the default...

PYSEC-2026-4070 LiteLLM Proxy has server-side request forgery via the `user_config` request parameter

Summary A server-side request forgery in LiteLLM Proxy lets an authenticated caller redirect the proxy's outbound request to a host of their choosing by smuggling an apibase inside the userconfig request body, bypassing the existing parameter guard. Details LiteLLM Proxy validates request bodies...

LiteLLM Proxy has server-side request forgery via the `user_config` request parameter

SummaryA server-side request forgery in LiteLLM Proxy lets an authenticated caller redirect theproxy's outbound request to a host of their choosing by smuggling an apibase inside theuserconfig request body, bypassing the existing parameter guard. DetailsLiteLLM Proxy validates request bodies with...

vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

SummaryCurrent vLLM main lets an inference request choose the PyNvVideoCodec GPU video decoder through mediaiokwargs.video.videobackend, but engine GPU memory reservation is computed only from static startup configuration and VLLMVIDEOLOADERBACKEND. If the server starts with the default...

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

SummaryWhen more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user's Open WebUI session cookies alongside that server's own key. The cookie jar is built per connection, but the callable...