32 matches found
MCPwnfluence
MCPwnfluence — CVE-2026-27825 и CVE-2026-27826 Две критические уязвимости в mcp-atlassian, одном из самых популярных MCP-серверов в экосистеме 4.4K+ звёзд на GitHub, 4M+ загрузок. Обнаружены командой Pluto Security. Уязвимости...
CVE-2026-27825
CVE-2026-27825 — Path Traversal в mcp-atlassian через confluenceuploadattachment Severity : Critical CVSS 9.3 CWE : CWE-22 — Path Traversal Affected : sooperset/mcp-atlassian = 0.17.0 чтение-аналог GHSA-xjgw-4wvw-rgm4 Advisory : GHSA NVD : https://nvd.nist.gov/vuln/detail/CVE-2026-27825 TL;DR...
mcp-atlassian < 0.17.0 - Server-Side Request Forgery
MCP Atlassian 0.17.0 contains a server-side request forgery caused by improper validation of custom HTTP headers in the HTTP middleware, letting unauthenticated attackers force outbound requests to arbitrary URLs, exploit requires access to the mcp-atlassian HTTP endpoint. id: CVE-2026-27826 info...
CVE-2026-73498 vulnerabilities
Vulnerabilities for packages: mcp-atlassian...
CVE-2026-73498
creationtimestamp| type| source ---|---|--- 2026-08-12 22:35:05+00:00| published-proof-of-concept| https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-g5r6-gv6m-f5jv 2026-08-12 23:01:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mswacrdtft22...
CVE-2026-73498
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...
CVE-2026-73498
The MCP Atlassian MCP server (Confluence/Jira) is affected by an arbitrary file read in confluence_upload_attachment prior to version 0.22.0. The function passes a client-supplied file_path directly to open(file_path, "rb") via _upload_attachment_direct() without validating the path, allowing an ...
CVE-2026-73498 MCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_attachment
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...
EUVD-2026-57639
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...
CVE-2026-73498
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...
CVE-2026-73498 MCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_attachment
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...
CVE-2026-73498 MCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_attachment
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...
PT-2026-71349
Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description The software fails to call validate safe path when processing the file path variable within the confluence upload attachment tool. This occurs in the upload attachment direct function located ...
CVE-2025-64340 vulnerabilities
Vulnerabilities for packages: mcp-atlassian...
CVE-2026-27124 vulnerabilities
Vulnerabilities for packages: mcp-atlassian...
GHSA-RWW4-4W9C-7733 vulnerabilities
Vulnerabilities for packages: mcp-atlassian...
GHSA-M8X7-R2RG-VH5G vulnerabilities
Vulnerabilities for packages: mcp-atlassian...
GHSA-WM45-QH3G-V83F vulnerabilities
Vulnerabilities for packages: mcp-atlassian...