The vulnerability CVE-2026-77268 affects sooperset's mcp-atlassian, a Model Context Protocol server for Atlassian products such as Confluence and Jira. Before version 0.22.0, the OAuth fallback token directory and JSON files (e.g., oauth-<client_id>.json) are created without owner-only permission modes. This misconfiguration allows local users or processes with group or world permissions to read sensitive access and refresh tokens, which can be reused to hijack Atlassian sessions. The advisory traces the vulnerable input and processing flow through the ~/.mcp-atlassian directory and related token files. The issue is resolved by enforcing stricter file permissions starting with version 0.22.0.

Local users or processes with access to the token files through group or world permissions can read OAuth access and refresh tokens. This exposure allows them to reuse Atlassian sessions, leading to potential unauthorized access to Atlassian services. The vulnerability does not affect confidentiality beyond token exposure and does not impact integrity or availability.

Upgrade to mcp-atlassian version 0.22.0 or later, where the issue is fixed by setting explicit owner-only permission modes on the OAuth fallback token directory and JSON files. No other mitigation is required as the fix is available.