MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, an HTTP transport deployment with READ_ONLY_MODE=false accepts a request without an Authorization identity and permits attacker-controlled Atlassian service headers, including X-Atlassian-Confluence-Url, to select a public attacker hostname or one allowed by MCP_ALLOWED_URL_DOMAINS. A caller can then invoke confluence_upload_attachment or the Jira attachment variant in src/mcp_atlassian/jira/attachments.py with a server-local file_path and cause the MCP process to send the file to the selected attachment endpoint. This issue is fixed in version 0.22.0.
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while upload_attachment accepts an unrestricted file_path. An unauthenticated network caller can read files available to the MCP process, upload them to an attacker-selected Jira issue or Confluence page, and retrieve the contents. The advisory traces the vulnerable input and processing flow through streamable-http, UserTokenMiddleware, upload_attachment, file_path, and _get_fetcher, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
CVE-2026-77256 is a vulnerability in sooperset's MCP Atlassian server affecting versions prior to 0.22.0. The issue involves incorrect permission assignment for a plaintext OAuth fallback file containing refresh and access tokens. Due to permissions inherited from the process umask, other local users may read this file under common or permissive configurations, potentially allowing unauthorized access to Atlassian products. The vulnerability is fixed in version 0.22.0.
CVE-2026-77249 is a Server-Side Request Forgery (SSRF) vulnerability in the MCP Atlassian server component for Atlassian products such as Confluence and Jira. The issue exists in versions prior to 0.22.0 where the JiraUserMixin._lookup_user_by_permissions method improperly uses the module-level requests.get function instead of a protected session. This allows an attacker to supply a public Jira URL that can redirect requests to internal addresses, bypassing redirect checks introduced in a previous fix (CVE-2026-27826). The vulnerability is fixed in version 0.22.0.
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment opens a caller-selected server-local file without checking that the resolved path remains in the workspace. A caller can upload environment files, credentials, or other readable host data to a Confluence page and retrieve it through Atlassian. The advisory traces the vulnerable input and processing flow through confluence_upload_attachment, file_path, and open(file_path, "rb"), which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bits can read access and refresh tokens and reuse the associated Atlassian session. The advisory traces the vulnerable input and processing flow through ~/.mcp-atlassian, oauth-<client_id>.json, access_token, and refresh_token, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
CVE-2026-77247 is a high-severity vulnerability in the MCP Atlassian server used by Atlassian products like Confluence and Jira. Versions prior to 0.22.0 allow permitted clients to control file path arguments during attachment uploads, enabling disclosure of host files without requiring shell or direct filesystem access. The flaw involves improper handling of caller-controlled paths in the upload process. This issue is fixed in version 0.22.0.
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth error query parameter is passed to CallbackHandler._send_response in oauth_setup.py and interpolated into an HTML page without escaping. A crafted authorization callback can inject markup or script that executes in the browser of a user completing the OAuth flow. This issue is fixed in version 0.22.0.
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the remediation for CVE-2026-27825 protects download destinations but does not constrain source paths used by attachment uploads. A caller can provide an absolute or traversal file_path and cause the server to upload the selected local file. The advisory traces the vulnerable input and processing flow through upload_attachment, file_path, and CVE-2026-27825, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
CVE-2026-77266 is a path traversal vulnerability in sooperset's MCP Atlassian server affecting versions prior to 0.22.0. The vulnerability allows an MCP caller with attachment access to read arbitrary files on the server by supplying absolute paths or traversal sequences to the upload_attachment function. This can lead to unauthorized disclosure of sensitive server-local files. The issue is fixed in version 0.22.0.
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the Jira update_issue attachments argument is converted into local paths and routed to the attachment upload implementation without workspace validation. A caller can make the MCP server read arbitrary local files and attach them to a Jira issue, using the server as a confused deputy to exfiltrate the contents. The advisory traces the vulnerable input and processing flow through jira update_issue, attachments, upload_attachment, and file_path, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment accepts an attacker-controlled file_path and does not apply the path restriction added for the earlier download vulnerability. A caller can traverse outside the workspace and upload arbitrary server-readable files to Confluence. The advisory traces the vulnerable input and processing flow through confluence_upload_attachment, file_path, and CVE-2026-27825, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
CVE-2026-77254 is a critical vulnerability in sooperset's MCP Atlassian server prior to version 0.22.0. It allows unauthenticated network callers to perform operations with operator-level permissions by exploiting missing authentication on the HTTP MCP endpoint. The flaw permits requests without per-user identity to reach tool handlers that use globally configured Jira or Confluence credentials. This issue is resolved in version 0.22.0.
CVE-2026-77253 is a path traversal vulnerability in sooperset's MCP Atlassian server affecting versions prior to 0.22.0. The flaw allows attackers with limited privileges to access arbitrary local filesystem paths via Jira and Confluence attachment upload tools, potentially exposing sensitive files such as configuration, credentials, or mounted secrets. The vulnerability is fixed in version 0.22.0.
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, HTTP-exposed Jira and Confluence upload tools pass a caller-provided file_path to local file operations without restricting it to the workspace. A remote MCP caller with tool access can cause the server to read sensitive local files and upload them as Atlassian attachments. The advisory traces the vulnerable input and processing flow through streamable-http, upload_attachment, and file_path, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, _make_ssrf_safe_hook is omitted from JiraFetcher and ConfluenceFetcher sessions created through the basic-auth and oauth_pat branches. If an attacker-controlled or compromised configured Atlassian instance returns a redirect to an internal address, those sessions can follow the redirect without revalidating its destination. This issue is fixed in version 0.22.0.
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the Confluence and Jira upload_attachment implementations accept an unconstrained file_path and open the referenced server-local file. A permitted MCP caller can upload sensitive host files to an Atlassian destination and then retrieve their contents. The advisory traces the vulnerable input and processing flow through upload_attachment, file_path, and CVE-2026-27825, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_safe_path defaults its base directory to os.getcwd(), and affected Confluence attachment call sites omit base_dir, allowing attacker-selected writes within the working directory. This Python module overwrite can provide code execution when the application later imports the modified module, bypassing the remediation tracked as CVE-2026-27825. This issue is fixed in version 0.22.0.
CVE-2026-77242 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in sooperset's mcp-atlassian server prior to version 0.22.0. The flaw arises because the hostname validation function validate_url_for_ssrf resolves DNS addresses separately from the actual connection attempt, allowing an attacker to exploit short-lived DNS responses to bypass SSRF protections. This can lead to unauthorized access to internal or metadata endpoints. The issue is fixed in version 0.22.0.
CVE-2026-77243 is a missing authorization vulnerability in sooperset's mcp-atlassian server affecting versions prior to 0.22.0. The flaw allows clients who know hidden tool names to invoke restricted read, write, or delete operations despite least-privilege configurations. This occurs because ENABLED_TOOLS and TOOLSETS are checked when listing tools but not rechecked when dispatching tool calls. The issue is fixed in version 0.22.0.