Sooperset

Mcp Atlassian

33 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.6

CVE-2026-77246

Exploit
  • EPSS 0.22%
  • Veröffentlicht 22.09.2026 18:51:54
  • Zuletzt bearbeitet 28.09.2026 14:31:10

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, an HTTP transport deployment with READ_ONLY_MODE=false accepts a request without an Authorization identity and permits attacker-cont...

8.6

CVE-2026-77248

  • EPSS 0.42%
  • Veröffentlicht 22.09.2026 18:49:57
  • Zuletzt bearbeitet 28.09.2026 13:33:54

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while upload_attachme...

6.5

CVE-2026-77256

  • EPSS 0.41%
  • Veröffentlicht 22.09.2026 18:48:58
  • Zuletzt bearbeitet 28.09.2026 13:18:25

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the plaintext OAuth fallback file containing refresh and access tokens is written with permissions inherited from the process umask....

5.3

CVE-2026-77249

Exploit
  • EPSS 0.33%
  • Veröffentlicht 22.09.2026 18:47:01
  • Zuletzt bearbeitet 29.09.2026 18:59:49

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, JiraUserMixin._lookup_user_by_permissions uses the module-level requests.get function instead of the fetcher's protected session. A ...

7.7

CVE-2026-77259

Exploit
  • EPSS 0.39%
  • Veröffentlicht 22.09.2026 18:45:48
  • Zuletzt bearbeitet 29.09.2026 13:03:37

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment opens a caller-selected server-local file without checking that the resolved path remains in the worksp...

5.5

CVE-2026-77268

Exploit
  • EPSS 0.11%
  • Veröffentlicht 22.09.2026 18:44:46
  • Zuletzt bearbeitet 29.09.2026 18:59:26

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access...

6.5

CVE-2026-77247

Exploit
  • EPSS 0.45%
  • Veröffentlicht 22.09.2026 18:34:32
  • Zuletzt bearbeitet 28.09.2026 14:37:25

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence upload tools interpret caller-controlled path arguments on the MCP server and open those files before sending th...

6.1

CVE-2026-77272

Exploit
  • EPSS 0.24%
  • Veröffentlicht 22.09.2026 18:33:18
  • Zuletzt bearbeitet 28.09.2026 13:10:43

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth error query parameter is passed to CallbackHandler._send_response in oauth_setup.py and interpolated into an HTML page wit...

6.5

CVE-2026-77269

Exploit
  • EPSS 0.38%
  • Veröffentlicht 22.09.2026 18:32:14
  • Zuletzt bearbeitet 29.09.2026 12:53:55

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the remediation for CVE-2026-27825 protects download destinations but does not constrain source paths used by attachment uploads. A ...

6.5

CVE-2026-77266

Exploit
  • EPSS 0.48%
  • Veröffentlicht 22.09.2026 18:30:58
  • Zuletzt bearbeitet 28.09.2026 13:14:12

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, upload_attachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An ...