pypi

mcp-atlassian

33 Total advisories

33 Vulnerabilities

0 Malware

Dependency scanning

Check whether mcp-atlassian is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

mcp-atlassian

Vulnerabilities

[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)

MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths

MCP Atlassian: Incomplete fix for GHSA-7r34-79r5-rcc9: redirect-based SSRF via unhooked requests session in Jira user-permission lookup

MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)

MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call

MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

MCP Atlassian: SSRF Protection Bypass

MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions

mcp-atlassian has an incomplete SSRF remediation

MCP Atlassian: Arbitrary File Read via Upload Attachment Tools

MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()

MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)

MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow

MCP Atlassian: Insecure File Permissions on OAuth Token Storage

MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)

MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport

MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches

MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)

mcp-atlassian: Arbitrary server-side file read via attachment upload

MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)

mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment

mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment

MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers

MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers

MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment

MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment

Browse more PyPI advisories

Start Securing