CVE-2026-77256

UNKNOWN 0.0

MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the plaintext OAuth fallback file containing refresh and access tokens is written with permissions inherited from the process umask. Under common or permissive configurations, other local users can read the backup and retain Atlassian access through the refresh token. The advisory traces the vulnerable input and processing flow through OAuthConfig._save_tokens_to_file, refresh_token, access_token, and umask, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

CWE	CWE-732
Vendor	sooperset
Product	mcp-atlassian
Published	Sep 22, 2026
Last Updated	Sep 22, 2026

Stay Ahead of the Next One

Get instant alerts for sooperset mcp-atlassian

Be the first to know when new unknown vulnerabilities affecting sooperset mcp-atlassian are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

sooperset / mcp-atlassian

< 0.22.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-76pr-5669-3xf5 github.com: https://github.com/sooperset/mcp-atlassian/pull/1448 github.com: https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460 github.com: https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0