Atlassian

Confluence

35 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.6

CVE-2026-77246

Exploit
  • EPSS 0.22%
  • Veröffentlicht 22.09.2026 18:51:54
  • Zuletzt bearbeitet 28.09.2026 14:31:10

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, an HTTP transport deployment with READ_ONLY_MODE=false accepts a request without an Authorization identity and permits attacker-cont...

8.6

CVE-2026-77248

  • EPSS 0.42%
  • Veröffentlicht 22.09.2026 18:49:57
  • Zuletzt bearbeitet 28.09.2026 13:33:54

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while upload_attachme...

6.5

CVE-2026-77256

  • EPSS 0.41%
  • Veröffentlicht 22.09.2026 18:48:58
  • Zuletzt bearbeitet 28.09.2026 13:18:25

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the plaintext OAuth fallback file containing refresh and access tokens is written with permissions inherited from the process umask....

5.3

CVE-2026-77249

Exploit
  • EPSS 0.33%
  • Veröffentlicht 22.09.2026 18:47:01
  • Zuletzt bearbeitet 29.09.2026 18:59:49

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, JiraUserMixin._lookup_user_by_permissions uses the module-level requests.get function instead of the fetcher's protected session. A ...

7.7

CVE-2026-77259

Exploit
  • EPSS 0.39%
  • Veröffentlicht 22.09.2026 18:45:48
  • Zuletzt bearbeitet 29.09.2026 13:03:37

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment opens a caller-selected server-local file without checking that the resolved path remains in the worksp...

6.5

CVE-2026-77247

Exploit
  • EPSS 0.45%
  • Veröffentlicht 22.09.2026 18:34:32
  • Zuletzt bearbeitet 28.09.2026 14:37:25

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence upload tools interpret caller-controlled path arguments on the MCP server and open those files before sending th...

6.5

CVE-2026-77266

Exploit
  • EPSS 0.48%
  • Veröffentlicht 22.09.2026 18:30:58
  • Zuletzt bearbeitet 28.09.2026 13:14:12

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, upload_attachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An ...

8.6

CVE-2026-77262

Exploit
  • EPSS 0.54%
  • Veröffentlicht 22.09.2026 18:13:10
  • Zuletzt bearbeitet 29.09.2026 18:59:33

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment accepts an attacker-controlled file_path and does not apply the path restriction added for the earlier ...

7.1

CVE-2026-77253

Exploit
  • EPSS 0.4%
  • Veröffentlicht 22.09.2026 18:10:31
  • Zuletzt bearbeitet 28.09.2026 13:23:46

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTT...

6.5

CVE-2026-77257

  • EPSS 0.41%
  • Veröffentlicht 22.09.2026 18:08:48
  • Zuletzt bearbeitet 29.09.2026 18:59:42

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, HTTP-exposed Jira and Confluence upload tools pass a caller-provided file_path to local file operations without restricting it to th...