mcp-atlassian < 0.17.0 - Server-Side Request Forgery

MCP Atlassian 0.17.0 contains a server-side request forgery caused by improper validation of custom HTTP headers in the HTTP middleware, letting unauthenticated attackers force outbound requests to arbitrary URLs, exploit requires access to the mcp-atlassian HTTP endpoint. id: CVE-2026-27826 info...

CVE-2026-77262

CVE-2026-77262 — Arbitrary File Read in mcp-atlassian via confluenceuploadattachment Severity : High CVSS 8.6 CWE : CWE-22 — Path Traversal Affected : sooperset/mcp-atlassian 0.22.0 Fixed in : 0.22.0 Advisory : GHSA-p6hp-93wp-fh6p NVD : https://nvd.nist.gov/vuln/detail/CVE-2026-77262 Credit :...

MCPwnfluence

MCPwnfluence — CVE-2026-27825 & CVE-2026-27826 Two critical vulnerabilities in mcp-atlassian, one of the most popular MCP servers in the ecosystem 4.4K+ GitHub stars, 4M+ downloads. Discovered by the team at Pluto Security. The Vulnerabilities CVE| CVSS| Type| Description ---|---|---|---...

mcp-atlassian has an incomplete SSRF remediation

SummaryThe UserTokenMiddleware extracts URLs from X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url HTTP headers and passes them directly to API client constructors without any SSRF validation. Affected Package- Ecosystem: PyPI- Package: mcp-atlassian- Affected versions: all versions before fix...

PYSEC-2026-4094 MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions

Summary When OAuth tokens are saved, MCP Atlassian always writes a plaintext fallback copy under /.mcp-atlassian/oauth-.json. The fallback file is created with the process default umask rather than restrictive permissions. In this environment the file was created as mode 0664, exposing access and...

[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

Descriptionmcp-atlassian deploys in two common patterns: Pattern A single-user, server-side credentials: operator sets JIRAUSERNAME + JIRAAPITOKEN or CONFLUENCEUSERNAME + CONFLUENCEAPITOKEN in environment variables. Server uses these to call Jira/Confluence. This is the documented quickstart...

MCP Atlassian: Incomplete fix for GHSA-7r34-79r5-rcc9: redirect-based SSRF via unhooked requests session in Jira user-permission lookup

SummaryThe fix for the SSRF vulnerability tracked as GHSA-7r34-79r5-rcc9 / CVE-2026-27826 is incomplete. That fix added two defenses: validateurlforssrf on the per-request X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers blocking a directly-internal base URL, and a redirect-validation ho...

MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)

SummaryThe path traversal fix introduced in v0.17.0 GHSA-xjgw-4wvw-rgm4 is incomplete. validatesafepath is called without an explicit basedir, defaulting to os.getcwd. In standard container deployments the process CWD is the application directory e.g. /app, so paths within that directory, includi...

PYSEC-2026-4103 [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

Description mcp-atlassian deploys in two common patterns: Pattern A single-user, server-side credentials: operator sets JIRAUSERNAME + JIRAAPITOKEN or CONFLUENCEUSERNAME + CONFLUENCEAPITOKEN in environment variables. Server uses these to call Jira/Confluence. This is the documented quickstart...

PYSEC-2026-4100 MCP Atlassian: Incomplete fix for GHSA-7r34-79r5-rcc9: redirect-based SSRF via unhooked requests session in Jira user-permission lookup

Summary The fix for the SSRF vulnerability tracked as GHSA-7r34-79r5-rcc9 / CVE-2026-27826 is incomplete. That fix added two defenses: validateurlforssrf on the per-request X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers blocking a directly-internal base URL, and a redirect-validation...

MCP Atlassian: SSRF Protection Bypass

Environment- Project: sooperset/mcp-atlassian- Affected function: validateurlforssrf- Affected path: header-based Jira/Confluence URL authentication flow- Tested endpoint: POST /mcp- Tested version: 2.14.5 DescriptionThe SSRF protection in validateurlforssrf can be bypassed with a URL containing ...

MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()

SummaryThe uploadattachment method in confluence/attachments.py reads and uploads arbitrary local files to Confluence without calling validatesafepath. Both download methods downloadattachment at line 223, downloadcontentattachments at line 272 correctly call validatesafepath before writing files...

MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

SummaryThe Jira and Confluence attachment upload tools accept caller-controlled file path parameters and read those paths from the MCP server's local filesystem before uploading the file as an Atlassian attachment.In local stdio deployments, this can expose files readable by the user's MCP proces...

MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions

SummaryWhen OAuth tokens are saved, MCP Atlassian always writes a plaintext fallback copy under /.mcp-atlassian/oauth-.json. The fallback file is created with the process default umask rather than restrictive permissions. In this environment the file was created as mode 0664, exposing access and...

PYSEC-2026-4092 MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

Summary The Jira and Confluence attachment upload tools accept caller-controlled file path parameters and read those paths from the MCP server's local filesystem before uploading the file as an Atlassian attachment. In local stdio deployments, this can expose files readable by the user's MCP...

PYSEC-2026-4084 mcp-atlassian has an incomplete SSRF remediation

Summary The UserTokenMiddleware extracts URLs from X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url HTTP headers and passes them directly to API client constructors without any SSRF validation. Affected Package - Ecosystem: PyPI - Package: mcp-atlassian - Affected versions: all versions before...

PYSEC-2026-4088 MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()

Summary The uploadattachment method in confluence/attachments.py reads and uploads arbitrary local files to Confluence without calling validatesafepath. Both download methods downloadattachment at line 223, downloadcontentattachments at line 272 correctly call validatesafepath before writing file...

PYSEC-2026-4087 MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)

Summary The path traversal fix introduced in v0.17.0 GHSA-xjgw-4wvw-rgm4 is incomplete. validatesafepath is called without an explicit basedir, defaulting to os.getcwd. In standard container deployments the process CWD is the application directory e.g. /app, so paths within that directory,...

PYSEC-2026-4096 MCP Atlassian: SSRF Protection Bypass

Environment - Project: sooperset/mcp-atlassian - Affected function: validateurlforssrf - Affected path: header-based Jira/Confluence URL authentication flow - Tested endpoint: POST /mcp - Tested version: 2.14.5 Description The SSRF protection in validateurlforssrf can be bypassed with a URL...

MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

SummaryENABLEDTOOLS and TOOLSETS filters are enforced at tools/list time only. tools/call dispatches from the full unfiltered tool registry 73 tools. Any user with access to the server endpoint that knows a tool name can invoke it directly. Tool names are not secret since mcp-atlassian is open...