Vulnerability details

CVE-2026-77256

sooperset mcp-atlassian

MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask

CVSS 4.0

8.3High

Official description

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the plaintext OAuth fallback file containing refresh and access tokens is written with permissions inherited from the process umask. Under common or permissive configurations, other local users can read the backup and retain Atlassian access through the refresh token. The advisory traces the vulnerable input and processing flow through OAuthConfig._save_tokens_to_file, refresh_token, access_token, and umask, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

CVSS scores

Score	Version	Source	Vector
8.3High	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N`

Affected products

Vendor	Product	Versions	Source
sooperset	mcp-atlassian	< 0.22.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/sooperset/mcp-atlassian/pull/1448 x_refsource_MISC
https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460 x_refsource_MISC
https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0 x_refsource_MISC
https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-76pr-5669-3xf5 x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-09-22
Last updated: 2026-09-22
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.34%

Probability of exploitation in 30 days

28.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-732
Incorrect Permission Assignment for Critical Resource