CVE-2026-77268

medium

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

Vendor / product: Mcp-atlassian — mcp atlassian

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bits can read access and refresh tokens and reuse the associated Atlassian session. The advisory traces the vulnerable input and processing flow through ~/.mcp-atlassian, oauth-.json, access_token, and refresh_token, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

CVSS

5.5

5.5 (CVSS v3.1)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Severity source: NVD CVSS v3.1 (security-advisories@github.com)

Timeline (UTC)

Published: 2026-09-22 19:16

Modified: 2026-09-29 18:59

NVD status: Analyzed

Last synced 2 days ago

Verified against the source API 2026-10-27 06:55 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

mcp-atlassian / mcp_atlassian <0.22.0

Weakness classification (CWE)

CWE-732

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-4596-2p6p-28cv

Patch / mitigation: https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460

Patch / mitigation: https://github.com/sooperset/mcp-atlassian/pull/1448

Patch / mitigation: https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-4596-2p6p-28cv

References

https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460 security-advisories@github.com
https://github.com/sooperset/mcp-atlassian/pull/1448 security-advisories@github.com
https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0 security-advisories@github.com
https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-4596-2p6p-28cv security-advisories@github.com

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:55 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-77268

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs