PyPI/mcp-atlassian CVE-2026-77248: high 8.6, EPSS 0.41%

MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport

Action: Upgrade mcp-atlassian to 0.22.0 or later.

pip install mcp-atlassian==0.22.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-4089
• https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-cc5h-2pwp-pvcc
• https://github.com/sooperset/mcp-atlassian/pull/1448
• https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460
• https://github.com/sooperset/mcp-atlassian
• https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0
• https://pypi.org/project/mcp-atlassian
• https://github.com/advisories/GHSA-cc5h-2pwp-pvcc
• https://nvd.nist.gov/vuln/detail/CVE-2026-77248

CVE-2026-77248 · published 2026-10-01T16:38:34.842921Z · modified 2026-10-01T17:45:10.923271578Z · JSON