Skip to content
OpenAdvisories

Vendor

sooperset

35 known vulnerabilities.

Products

mcp-atlassian 35
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-77254

    MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials

    MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured Jira or …

    sooperset mcp-atlassian
  • Critical 10.0
    CVE-2026-77244

    [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

    MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the HTTP transport accepts requests without a verified user identity and downstream fetcher construction falls back to the operator's globall…

    sooperset mcp-atlassian mcp-atlassian PyPI
  • Critical 9.1
    CVE-2026-27825 Public exploit EPSS 12%

    MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment

    MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, the `confluence_download_attachment` MCP tool accepts a `download_path` parameter that is written to without any directory boundary e…

    sooperset mcp-atlassian mcp-atlassian PyPI