CVE-2026-77244: Improper Authentication

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the HTTP transport accepts requests without a verified user identity and downstream fetcher construction falls back to the operator's globally configured Jira or Confluence credential...

PT-2026-96945

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the...

PT-2026-96928

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description An arbitrary local file read issue exists in the Confluence and Jira upload attachment tool paths. The implementation accepts an unconstrained file path and opens the referenced server-local...

PT-2026-96952

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description The upload attachment function in both the Jira and Confluence modules fails to constrain the resolved path to the server workspace, allowing the use of absolute paths and traversal sequences...

PT-2026-96926

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description Three distinct issues allow attacker-controlled queries to access content from forbidden projects or spaces, bypassing the restrictions set by the JIRA PROJECTS FILTER and CONFLUENCE SPACES...

PT-2026-96950

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description Missing path validation in the confluence upload attachment function allows an authenticated client to read arbitrary files from the server filesystem and exfiltrate their contents to a...

PT-2026-96951

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions 0.17.0 through 0.21.0 Description A path traversal issue exists in the confluence upload attachment tool. The file path variable is passed directly to the open function without proper validation, allowing a caller to rea...

PT-2026-96900

Name of the Vulnerable Software and Affected Versions mcp-atlassian versions prior to 0.22.0 Description The HTTP transport in mcp-atlassian accepts requests without a verified user identity. When no valid user token is provided, the system falls back to using the operator's globally configured...

PT-2026-96904

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description A backslash authority confusion exists in the header-based Jira and Confluence URL authentication flow. The validate url for ssrf function interprets the authority of a URL differently than th...

CVE-2026-77247: External Control of File Name or Path

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira and Confluence upload tools interpret caller-controlled path arguments on the MCP server and open those files before sending them as attachments. In remote or multi-user...

CVE-2026-77265: Server-Side Request Forgery (SSRF)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, header-supplied Jira or Confluence URLs are resolved and validated before the HTTP client resolves the hostname again for the connection. An unauthenticated caller can use a...

Atlassian Confluence 8.9.0 < 9.2.24 / 9.3.1 < 10.2.17 (CONFSERVER-104362)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104362 advisory. - Impact: The fix for CVE-2021-23337 https://github.com/advisories/GHSA-35jh-r3h4-6jhm added validation for the variable option in .template but di...

RCE (Remote Code Execution) org.bouncycastle:bcprov-lts8on Dependency in Confluence Data Center

This High severity RCE Remote Code Execution vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This RCE Remote Code Execution vulnerability, with a CVSS Score of 7.1 and a CVSS Vector of...

Cryptographic Failure org.bouncycastle:bcprov-lts8on Dependency in Confluence Data Center

This High severity Cryptographic Failure vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Cryptographic Failure vulnerability, with a CVSS Score of 8.7 and a CVSS Vector...

Security Misconfiguration org.bouncycastle:bcprov-lts8on Dependency in Confluence Data Center

This High severity Security Misconfiguration vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Security Misconfiguration vulnerability, with a CVSS Score of 7.1 and a CVSS Vector of...

CVE-2026-21588

This High severity DoS Denial of Service vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a...

CVE-2026-21586

This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an...

CVE-2026-21588

This High severity DoS Denial of Service vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a...

EUVD-2026-78935

This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an...

CVE-2026-21588

This High severity DoS Denial of Service vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a...