Skip to contentSooperset Mcp-atlassian vulnerabilities
- sooperset mcp-atlassiansooperset mcp-atlassian io.py validate_safe_path path traversalCVE-2026-1245035.3 Medium
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload PathCVE-2026-77246Fix available7.4 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transportCVE-2026-77248Fix available8.6 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umaskCVE-2026-772568.3 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Incomplete fix for CVE-2026-27826: redirect-based SSRF via unhooked requests session in Jira user-permission lookupCVE-2026-77249Fix available5.3 Medium
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentialsCVE-2026-77259Fix available7.7 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Insecure File Permissions on OAuth Token StorageCVE-2026-77268Fix available5.5 Medium
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parametersCVE-2026-77247Fix available8.3 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Reflected XSS in OAuth Setup Callback HandlerCVE-2026-77272Fix available5.4 Medium
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)CVE-2026-77269Fix available6.5 Medium
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool callCVE-2026-77266Fix available6.5 Medium
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issueCVE-2026-77255Fix available8.6 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825)CVE-2026-77262Public exploitFix available8.6 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentialsCVE-2026-772549.1 Critical
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local filesCVE-2026-77253Fix available7.1 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: HTTP upload tools accept arbitrary server-local file pathsCVE-2026-77257Fix available8.3 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branchesCVE-2026-77261Fix available7.1 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)CVE-2026-77260Fix available8.3 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)CVE-2026-77271Fix available8.3 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned)CVE-2026-772427.5 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: ENABLED_TOOLS / Toolset authorization bypassCVE-2026-77243Fix available8.8 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)CVE-2026-77251Fix available8.3 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER can be bypassed in search toolsCVE-2026-772526.5 Medium
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moremcp-atlassian has an incomplete SSRF remediationCVE-2026-77267Fix available8.3 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissionsCVE-2026-77250Fix available6.1 Medium
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 more[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty tokenCVE-2026-77244Fix available10.0 Critical
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication FlowCVE-2026-77265Fix available5.9 Medium
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Arbitrary File Read via Upload Attachment ToolsCVE-2026-77270Fix available6.5 Medium
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()CVE-2026-77258Fix available7.7 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: SSRF Protection BypassCVE-2026-77274Fix available8.8 High
- sooperset mcp-atlassianMCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_attachmentCVE-2026-73498Fix available7.7 High
- sooperset mcp-atlassianMCP Atlassian: Arbitrary server-side file read via attachment uploadCVE-2026-73496Fix available7.7 High
- sooperset mcp-atlassianMCP Atlassian is a Model Context Protocol (MCP): DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826): unauthenticated SSRF to cloud metadataCVE-2026-73497Fix available6.5 Medium
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachmentCVE-2026-27825Public exploitFix availableEPSS 12.3%9.1 Critical
- sooperset mcp-atlassian, mcp atlassian +1 moreMCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headersCVE-2026-27826Fix availableEPSS 13.9%8.2 High