CVE-2026-77256

Katalog CVE

CVSS 6.5 · Medium EPSS 0,35%

Kerentanan Incorrect Permission Assignment for Critical Resource pada mcp-atlassian mcp atlassian. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the plaintext OAuth fallback file containing refresh and access tokens is written with permissions inherited from the process umask. Under common or permissive configurations, other local users can read the backup and retain Atlassian access through the refresh token. The advisory traces the vulnerable input and processing flow through OAuthConfig._save_tokens_to_file, refresh_token, access_token, and umask, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Rincian

Terbit di NVD

22 September 2026

Terakhir diubah

28 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-76pr-5669-3xf5 mitigasi · advisory vendor
• https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460 patch
• https://github.com/sooperset/mcp-atlassian/pull/1448 issue tracking · patch
• https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0 release notes