CVE-2026-77256

Description

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the plaintext OAuth fallback file containing refresh and access tokens is written with permissions inherited from the process umask. Under common or permissive configurations, other local users can read the backup and retain Atlassian access through the refresh token. The advisory traces the vulnerable input and processing flow through OAuthConfig._save_tokens_to_file, refresh_token, access_token, and umask, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

References

https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-76pr-5669-3xf5

https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0

https://github.com/sooperset/mcp-atlassian/pull/1448

https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84761

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS