Mcp-atlassian

Mcp Atlassian

30 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.6

CVE-2026-77255

Exploit
  • EPSS 0.4%
  • Veröffentlicht 22.09.2026 18:29:20
  • Zuletzt bearbeitet 29.09.2026 13:41:25

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the Jira update_issue attachments argument is converted into local paths and routed to the attachment upload implementation without ...

8.6

CVE-2026-77262

Exploit
  • EPSS 0.54%
  • Veröffentlicht 22.09.2026 18:13:10
  • Zuletzt bearbeitet 29.09.2026 18:59:33

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment accepts an attacker-controlled file_path and does not apply the path restriction added for the earlier ...

9.1

CVE-2026-77254

Exploit
  • EPSS 0.61%
  • Veröffentlicht 22.09.2026 18:11:44
  • Zuletzt bearbeitet 28.09.2026 13:22:14

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured...

7.1

CVE-2026-77253

Exploit
  • EPSS 0.4%
  • Veröffentlicht 22.09.2026 18:10:31
  • Zuletzt bearbeitet 28.09.2026 13:23:46

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTT...

6.5

CVE-2026-77257

  • EPSS 0.41%
  • Veröffentlicht 22.09.2026 18:08:48
  • Zuletzt bearbeitet 29.09.2026 18:59:42

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, HTTP-exposed Jira and Confluence upload tools pass a caller-provided file_path to local file operations without restricting it to th...

8.5

CVE-2026-77261

Exploit
  • EPSS 0.26%
  • Veröffentlicht 22.09.2026 18:06:20
  • Zuletzt bearbeitet 25.09.2026 17:36:32

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, _make_ssrf_safe_hook is omitted from JiraFetcher and ConfluenceFetcher sessions created through the basic-auth and oauth_pat branche...

7.5

CVE-2026-77260

Exploit
  • EPSS 0.32%
  • Veröffentlicht 22.09.2026 18:03:03
  • Zuletzt bearbeitet 29.09.2026 13:56:16

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the Confluence and Jira upload_attachment implementations accept an unconstrained file_path and open the referenced server-local fil...

8.8

CVE-2026-77271

Exploit
  • EPSS 0.42%
  • Veröffentlicht 22.09.2026 18:00:33
  • Zuletzt bearbeitet 28.09.2026 13:45:34

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_safe_path defaults its base directory to os.getcwd(), and affected Confluence attachment call sites omit base_dir, allowing...

7.5

CVE-2026-77242

Exploit
  • EPSS 0.29%
  • Veröffentlicht 22.09.2026 17:58:41
  • Zuletzt bearbeitet 29.09.2026 15:41:42

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf checks a hostname's resolved addresses, but Requests and urllib3 resolve the hostname again when connecting. A...

8.8

CVE-2026-77243

Exploit
  • EPSS 0.36%
  • Veröffentlicht 22.09.2026 17:57:26
  • Zuletzt bearbeitet 29.09.2026 15:32:58

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, ENABLED_TOOLS and TOOLSETS are applied when tools are listed but are not rechecked when a tools/call request is dispatched. A client...