Login Request a demo
MA
Product
Mcp Atlassian
by Mcp-atlassian · last CVE Sep 22, 2026
30
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities30In the news0Timeline
Severity mix
Critical 2High 15Medium 13Low 0
Severity
All severities30Critical2High15Medium13Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Mcp Atlassian to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-77256
6.5
0%
Sep 22
MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask
Affected: before 0.22.0
CVE-2026-77247
6.5
0%
Sep 22
MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters
Affected: before 0.22.0
CVE-2026-77269
6.5
0%
Sep 22
MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)
Affected: before 0.22.0
CVE-2026-77266
6.5
0%
Sep 22
MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call
Affected: before 0.22.0
CVE-2026-77257
6.5
0%
Sep 22
MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths
Affected: before 0.22.0
CVE-2026-77251
6.5
0%
Sep 22
MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)
Affected: before 0.22.0
CVE-2026-77252
6.5
0%
Sep 22
MCP Atlassian: JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER can be bypassed in search tools
Affected: before 0.22.0
CVE-2026-77267
6.5
0%
Sep 22
mcp-atlassian has an incomplete SSRF remediation
Affected: before 0.22.0
CVE-2026-77270
6.5
0%
Sep 22
MCP Atlassian: Arbitrary File Read via Upload Attachment Tools
Affected: before 0.22.0
CVE-2026-77272
6.1
0%
Sep 22
MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler
Affected: before 0.22.0
CVE-2026-77250
6.1
0%
Sep 22
MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions
Affected: before 0.22.0
CVE-2026-77268
5.5
0%
Sep 22
MCP Atlassian: Insecure File Permissions on OAuth Token Storage
Affected: before 0.22.0
CVE-2026-77249
5.3
0%
Sep 22
MCP Atlassian: Incomplete fix for CVE-2026-27826: redirect-based SSRF via unhooked requests session in Jira user-permission lookup
Affected: before 0.22.0
Showing 13