VulnSocial

CVE-2026-77269Disclosure(mcp-atlassian / mcp_atlassian)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the remediation for CVE-2026-27825 protects download destinations but does not constrain source paths used by attachment uploads. A caller can provide an absolute or traversal file_path and cause the server to upload the selected local file. The advisory traces the vulnerable input and processing flow through upload_attachment, file_path, and CVE-2026-27825, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

mcp-atlassian CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • mcp_atlassian

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
mcp-atlassian
Products
mcp_atlassian

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-23: 1Technical Details · 2026-09-23: 109-23
Signal classification1 categories
Disclosure
1100.0%
Full discourse1 post
  • Daniel Cuthbert@dcuthbert
    Disclosure

    Seriously @Atlassian asking for the community here. How on gods green earth did you end up shipping MCP server full of appsec bugs? CVE-2026-77242 SSRF CVE-2026-77267 validation bypass CVE-2026-77269 path traversal With all the AI, you still had bugs older than most

    Post summary

    The tweet discloses three CVEs (SSRF, validation bypass, path traversal) found in an Atlassian MCP server, criticizing the vendor for shipping software with known security bugs.

    7014483.0K
    33.7K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appmcp-atlassianmcp_atlassian---

Explore more

Back to dashboardmcp-atlassian CVEsmcp_atlassian vulnerabilities