Security
فارسی
All products

mcp-atlassian

PyPI · Package
30 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)CVE-2026-77260 · GHSA-F4P7-QX46-WC5JVersion ranges need review. mcp-atlassian PyPI High Fix reported
MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload PathCVE-2026-77246 · GHSA-WV8V-V4C5-V75JVersion ranges need review. mcp-atlassian PyPI High Fix reported
MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissionsCVE-2026-77250 · GHSA-G5XV-MHGM-V5F6Version ranges need review. mcp-atlassian PyPI Medium Fix reported
MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transportCVE-2026-77248 · GHSA-CC5H-2PWP-PVCCVersion ranges need review. mcp-atlassian PyPI High Fix reported
MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)CVE-2026-77271 · GHSA-6VMQ-24H2-PJ7JVersion ranges need review. mcp-atlassian PyPI High Fix reported
MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)CVE-2026-77251 · GHSA-W66G-J6C4-HCFCVersion ranges need review. mcp-atlassian PyPI High Fix reported
MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parametersCVE-2026-77247 · GHSA-F6PJ-QV47-G96WVersion ranges need review. mcp-atlassian PyPI High Fix reported
MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication FlowCVE-2026-77265 · GHSA-49XV-9743-PW8WVersion ranges need review. mcp-atlassian PyPI Medium Fix reported
mcp-atlassian has an incomplete SSRF remediationCVE-2026-77267 · GHSA-5WF4-JQXH-8GM3Version ranges need review. mcp-atlassian PyPI High Fix reported
MCP Atlassian: SSRF Protection BypassCVE-2026-77274 · GHSA-HGCF-4MQ8-5266Version ranges need review. mcp-atlassian PyPI High Fix reported
MCP Atlassian: Reflected XSS in OAuth Setup Callback HandlerCVE-2026-77272 · GHSA-G2R2-3J32-J27XVersion ranges need review. mcp-atlassian PyPI Medium Fix reported
MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypassCVE-2026-77243 · GHSA-3R68-HF9H-887VVersion ranges need review. mcp-atlassian PyPI High Fix reported
MCP Atlassian: Insecure File Permissions on OAuth Token StorageCVE-2026-77268 · GHSA-4596-2P6P-28CVVersion ranges need review. mcp-atlassian PyPI Medium Fix reported
MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentialsCVE-2026-77259 · GHSA-6CR4-CCF3-X7H4Version ranges need review. mcp-atlassian PyPI High Fix reported
MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)CVE-2026-77262 · GHSA-P6HP-93WP-FH6PVersion ranges need review. mcp-atlassian PyPI High Fix reported
[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty tokenCVE-2026-77244 · GHSA-WRHW-J3F9-8VC6Version ranges need review. mcp-atlassian PyPI Critical Fix reported
MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local filesCVE-2026-77253 · GHSA-VC25-24VV-FXXMVersion ranges need review. mcp-atlassian PyPI High Fix reported
MCP Atlassian: Arbitrary File Read via Upload Attachment ToolsCVE-2026-77270 · GHSA-F26R-J276-GGG4Version ranges need review. mcp-atlassian PyPI Medium Fix reported
MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issueCVE-2026-77255 · GHSA-2XJ6-XX86-CWWCVersion ranges need review. mcp-atlassian PyPI High Fix reported
MCP Atlassian: HTTP upload tools accept arbitrary server-local file pathsCVE-2026-77257 · GHSA-MRQ8-FV7V-HHJGVersion ranges need review. mcp-atlassian PyPI High Fix reported