PT-2026-96948 · Unknown · Mcp-Attlasian
CVE-2026-77256
·
Published
2026-09-22
·
Updated
2026-09-28
CVSS v4.0
8.3
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
MCP Atlassian versions prior to 0.22.0
Description
The software writes a plaintext OAuth fallback file containing
refresh token and access token using permissions inherited from the process umask (a user file-creation mode mask). In permissive configurations, this allows other local users to read the file and maintain unauthorized access to Atlassian products. The issue occurs during the processing flow within the OAuthConfig. save tokens to file function.Recommendations
Update to version 0.22.0.
Exploit
Fix
Incorrect Permission
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mcp-Attlasian