32 matches found
mcp-atlassian < 0.17.0 - Server-Side Request Forgery
MCP Atlassian 0.17.0 contains a server-side request forgery caused by improper validation of custom HTTP headers in the HTTP middleware, letting unauthenticated attackers force outbound requests to arbitrary URLs, exploit requires access to the mcp-atlassian HTTP endpoint. id: CVE-2026-27826 info...
MCPwnfluence
MCPwnfluence — CVE-2026-27825 & CVE-2026-27826 mcp-atlassian（エコシステムで最も人気のあるMCPサーバーの1つ、GitHubスター4.4K以上、ダウンロード数400万以上）における2つの重大な脆弱性。 Pluto Security のチームによって発見されました。 脆弱性の概要...
CVE-2026-27825
CVE-2026-27825 — mcp-atlassian の confluenceuploadattachment におけるパストラバーサル 深刻度 : Critical CVSS 9.3 CWE : CWE-22 — パストラバーサル 影響を受けるバージョン : sooperset/mcp-atlassian = 0.17.0 GHSA-xjgw-4wvw-rgm4 の読み取り側の双子 アドバイザリ : GHSA NVD : https://nvd.nist.gov/vuln/detail/CVE-2026-27825 TL;DR confluenceuploadattachmen...
CVE-2026-73498 vulnerabilities
Vulnerabilities for packages: mcp-atlassian...
CVE-2026-73498
creationtimestamp| type| source ---|---|--- 2026-08-12 22:35:05+00:00| published-proof-of-concept| https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-g5r6-gv6m-f5jv 2026-08-12 23:01:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mswacrdtft22...
CVE-2026-73498
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...
EUVD-2026-57639
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...
CVE-2026-73498
The MCP Atlassian MCP server (Confluence/Jira) is affected by an arbitrary file read in confluence_upload_attachment prior to version 0.22.0. The function passes a client-supplied file_path directly to open(file_path, "rb") via _upload_attachment_direct() without validating the path, allowing an ...
CVE-2026-73498 MCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_attachment
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...
CVE-2026-73498
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...
CVE-2026-73498 MCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_attachment
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...
CVE-2026-73498 MCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_attachment
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...
PT-2026-71349
Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description The software fails to call validate safe path when processing the file path variable within the confluence upload attachment tool. This occurs in the upload attachment direct function located ...
CVE-2025-64340 vulnerabilities
Vulnerabilities for packages: mcp-atlassian...
CVE-2026-27124 vulnerabilities
Vulnerabilities for packages: mcp-atlassian...
GHSA-RWW4-4W9C-7733 vulnerabilities
Vulnerabilities for packages: mcp-atlassian...
GHSA-M8X7-R2RG-VH5G vulnerabilities
Vulnerabilities for packages: mcp-atlassian...
GHSA-WM45-QH3G-V83F vulnerabilities
Vulnerabilities for packages: mcp-atlassian...