Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the exec rendering mode during certain error conditions, specifically when numretries is met. An attacker can obtain sensitive information by accessing stdout output that may contain...

KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes

Description KubeEdge ConfigUpdateJob processing was vulnerable to command injection on edge nodes. The updateFields values from a ConfigUpdateJob were concatenated into a command string and executed through a system shell. An authenticated user with sufficient permissions to create or update...

GHSA-M3C6-2P7H-CFR3 KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes

Description KubeEdge ConfigUpdateJob processing was vulnerable to command injection on edge nodes. The updateFields values from a ConfigUpdateJob were concatenated into a command string and executed through a system shell. An authenticated user with sufficient permissions to create or update...

EUVD-2026-84032

KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes...

GHSA-72H8-WP98-7HCH Unleash: Missing await on permission check + cross-project IDOR in admin API

Summary Multiple authorization vulnerabilities in Unleash admin API, including a critical missing await that completely bypasses a permission check. Vulnerability 1: Missing await on Permission Check HIGH File: src/lib/features/segment/segment-controller.ts line 345 POST...

NPM: Unleash: Missing await on permission check + cross-project IDOR in admin API

NPM: Unleash: Missing await on permission check + cross-project IDOR in admin API vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

Unleash: Missing await on permission check + cross-project IDOR in admin API

Summary Multiple authorization vulnerabilities in Unleash admin API, including a critical missing await that completely bypasses a permission check. Vulnerability 1: Missing await on Permission Check HIGH File: src/lib/features/segment/segment-controller.ts line 345 POST...

NPM: Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log

NPM: Unleash: A project member can reorder activation strategies belonging to any other project / environment cross-project integrity write, bypassing project RBAC and the audit log vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log

Summary Unleash scopes write permissions per project and per environment: a user with the UPDATEFEATURESTRATEGY permission on project A is supposed to be able to mutate activation strategies only within project A. The endpoint POST...

GHSA-5FFH-6F9Q-5HHR Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log

Summary Unleash scopes write permissions per project and per environment: a user with the UPDATEFEATURESTRATEGY permission on project A is supposed to be able to mutate activation strategies only within project A. The endpoint POST...

GHSA-93XW-J965-9MX3 MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()

Summary The uploadattachment method in confluence/attachments.py reads and uploads arbitrary local files to Confluence without calling validatesafepath. Both download methods downloadattachment at line 223, downloadcontentattachments at line 272 correctly call validatesafepath before writing file...

MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()

Summary The uploadattachment method in confluence/attachments.py reads and uploads arbitrary local files to Confluence without calling validatesafepath. Both download methods downloadattachment at line 223, downloadcontentattachments at line 272 correctly call validatesafepath before writing file...

MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions

Summary When OAuth tokens are saved, MCP Atlassian always writes a plaintext fallback copy under /.mcp-atlassian/oauth-.json. The fallback file is created with the process default umask rather than restrictive permissions. In this environment the file was created as mode 0664, exposing access and...

GHSA-G5XV-MHGM-V5F6 MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions

Summary When OAuth tokens are saved, MCP Atlassian always writes a plaintext fallback copy under /.mcp-atlassian/oauth-.json. The fallback file is created with the process default umask rather than restrictive permissions. In this environment the file was created as mode 0664, exposing access and...

MCP Atlassian: Incomplete fix for GHSA-7r34-79r5-rcc9: redirect-based SSRF via unhooked requests session in Jira user-permission lookup

Summary The fix for the SSRF vulnerability tracked as GHSA-7r34-79r5-rcc9 / CVE-2026-27826 is incomplete. That fix added two defenses: validateurlforssrf on the per-request X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers blocking a directly-internal base URL, and a redirect-validation...

GHSA-V9M3-WFH8-5646 MCP Atlassian: Incomplete fix for GHSA-7r34-79r5-rcc9: redirect-based SSRF via unhooked requests session in Jira user-permission lookup

Summary The fix for the SSRF vulnerability tracked as GHSA-7r34-79r5-rcc9 / CVE-2026-27826 is incomplete. That fix added two defenses: validateurlforssrf on the per-request X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers blocking a directly-internal base URL, and a redirect-validation...

GHSA-F6PJ-QV47-G96W MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

Summary The Jira and Confluence attachment upload tools accept caller-controlled file path parameters and read those paths from the MCP server's local filesystem before uploading the file as an Atlassian attachment. In local stdio deployments, this can expose files readable by the user's MCP...

MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

Summary The Jira and Confluence attachment upload tools accept caller-controlled file path parameters and read those paths from the MCP server's local filesystem before uploading the file as an Atlassian attachment. In local stdio deployments, this can expose files readable by the user's MCP...

[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

Description mcp-atlassian deploys in two common patterns: Pattern A single-user, server-side credentials: operator sets JIRAUSERNAME + JIRAAPITOKEN or CONFLUENCEUSERNAME + CONFLUENCEAPITOKEN in environment variables. Server uses these to call Jira/Confluence. This is the documented quickstart...

GHSA-WRHW-J3F9-8VC6 [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

Description mcp-atlassian deploys in two common patterns: Pattern A single-user, server-side credentials: operator sets JIRAUSERNAME + JIRAAPITOKEN or CONFLUENCEUSERNAME + CONFLUENCEAPITOKEN in environment variables. Server uses these to call Jira/Confluence. This is the documented quickstart...