CVE-2026-77256

medium

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

Vendor / product: Mcp-atlassian — mcp atlassian

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the plaintext OAuth fallback file containing refresh and access tokens is written with permissions inherited from the process umask. Under common or permissive configurations, other local users can read the backup and retain Atlassian access through the refresh token. The advisory traces the vulnerable input and processing flow through OAuthConfig._save_tokens_to_file, refresh_token, access_token, and umask, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

CVSS

6.5

6.5 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2026-09-22 19:16

Modified: 2026-09-28 13:18

NVD status: Analyzed

Last synced 2 days ago

Verified against the source API 2026-10-27 06:55 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

mcp-atlassian / mcp_atlassian <0.22.0

Weakness classification (CWE)

CWE-732

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-76pr-5669-3xf5

Patch / mitigation: https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460

Patch / mitigation: https://github.com/sooperset/mcp-atlassian/pull/1448

Patch / mitigation: https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-76pr-5669-3xf5

References

https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460 security-advisories@github.com
https://github.com/sooperset/mcp-atlassian/pull/1448 security-advisories@github.com
https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0 security-advisories@github.com
https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-76pr-5669-3xf5 security-advisories@github.com
https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-76pr-5669-3xf5 134c704f-9b21-4f2e-91b3-4a467353bcc0

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:55 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-77256

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs