Advisories · Technology

sooperset mcp-atlassian.

Every CVE that names sooperset mcp-atlassian among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-77256 CVE record

CVSS 8.3 High

MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask
- sooperset mcp-atlassian
- Broken access control
Not analysed yet 22 Sept 2026
CVE-2026-77254 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials
- sooperset mcp-atlassian
- Authentication bypass
Not analysed yet 22 Sept 2026
CVE-2026-77242 CVE record

CVSS 7.5 High

MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned)
- sooperset mcp-atlassian
- Race condition
- Server-side request forgery (SSRF)
Not analysed yet 22 Sept 2026
CVE-2026-77252 CVE record

CVSS 6.5 Medium

MCP Atlassian: JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER can be bypassed in search tools
- sooperset mcp-atlassian
- Broken access control
Not analysed yet 22 Sept 2026