PyPI/mcp-atlassian CVE-2026-77253: high 7.1, EPSS 0.44%

MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

Action: Upgrade mcp-atlassian to 0.22.0 or later.

pip install mcp-atlassian==0.22.0

Affected

Fixed versions

Sources

• osv: GHSA-vc25-24vv-fxxm
• https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc25-24vv-fxxm
• https://github.com/sooperset/mcp-atlassian/pull/1448
• https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460
• https://github.com/sooperset/mcp-atlassian
• https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0

CVE-2026-77253 · published 2026-09-22T20:34:50Z · modified 2026-10-01T17:55:53.636325142Z · JSON