Executive brief
The MCP Atlassian tool stores OAuth credentials (access tokens, refresh tokens, and cloud IDs) in fallback files with world-readable permissions. Any user on a shared system can read these files to gain full unauthorized access to the victim's Jira and Confluence data indefinitely, since refresh tokens allow generating new access tokens.
Technical details
The vulnerability exists in the `_save_tokens_to_file()` method in `src/mcp_atlassian/utils/oauth.py`. Token files are created with default filesystem permissions (0644 on Linux) containing sensitive OAuth credentials including access tokens, refresh tokens, cloud IDs, and base URLs. The token directory is created with mode 0755, and the JSON file is written without explicit permission restrictions via `os.open()` with protective flags. Attack requires local system access to read the fallback token files (typically `~/.mcp-atlassian/oauth-*.json`). An attacker can immediately use the stolen access token to impersonate the victim, and use the refresh token to maintain indefinite access even after token expiration. The fix requires using `os.open()` with mode 0o600 (owner-only) and `Path.mkdir(mode=0o700)` for the directory.
Affected products
- Atlassian MCP Atlassian <UNKNOWN>
Timeline
- 2026-09-22: disclosed
- other: CVE-2026-77268 assigned