mcp-atlassian vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-77258Highmcp-atlassian: MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()CVE-2026-77250Mediummcp-atlassian: MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissionsCVE-2026-77249Mediummcp-atlassian: MCP Atlassian: Incomplete fix for GHSA-7r34-79r5-rcc9: redirect-based SSRF via unhooked requests session in Jira user-permission lookupCVE-2026-77247Highmcp-atlassian: MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parametersCVE-2026-77244Criticalmcp-atlassian: [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty tokenCVE-2026-77274Highmcp-atlassian: MCP Atlassian: SSRF Protection BypassCVE-2026-77271Highmcp-atlassian: MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)CVE-2026-77267Highmcp-atlassian: mcp-atlassian has an incomplete SSRF remediationCVE-2026-77272Mediummcp-atlassian: MCP Atlassian: Reflected XSS in OAuth Setup Callback HandlerCVE-2026-77262Highmcp-atlassian: MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)CVE-2026-77268Mediummcp-atlassian: MCP Atlassian: Insecure File Permissions on OAuth Token StorageCVE-2026-77259Highmcp-atlassian: MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentialsCVE-2026-77261Highmcp-atlassian: MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branchesCVE-2026-77270Mediummcp-atlassian: MCP Atlassian: Arbitrary File Read via Upload Attachment ToolsCVE-2026-77265Mediummcp-atlassian: MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication FlowCVE-2026-77266Mediummcp-atlassian: MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool callCVE-2026-77269Mediummcp-atlassian: MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)CVE-2026-77260Highmcp-atlassian: MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)CVE-2026-77257Highmcp-atlassian: MCP Atlassian: HTTP upload tools accept arbitrary server-local file pathsCVE-2026-77243Highmcp-atlassian: MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypassCVE-2026-77255Highmcp-atlassian: MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issueCVE-2026-77253Highmcp-atlassian: MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local filesCVE-2026-77251Highmcp-atlassian: MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian…CVE-2026-77246Highmcp-atlassian: MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload PathCVE-2026-77248Highmcp-atlassian: MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http…

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo