CVE-2026-77268: Atlassian MCP insecure OAuth token file permissions

CVE-2026-77268 · Severity: medium · CVSS 5.5 · Published 2026-09-22

The MCP Atlassian tool stores OAuth credentials (access tokens, refresh tokens, and cloud IDs) in fallback files with world-readable permissions. Any user on a shared system can read these files to gain full unauthorized access to the victim's Jira and Confluence data indefinitely, since refresh tokens allow generating new access tokens.

Technologies: mcp-atlassian (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-77268 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77268 being exploited in the wild.
How severe is CVE-2026-77268?
Medium severity, with a CVSS score of 5.5, published 22 September 2026.
Which products and versions are affected?
mcp-atlassian (PyPI) < 0.22.0, ECOSYSTEM:introduced=0,fixed=0.22.0.
Is there a fix for CVE-2026-77268?
Yes. mcp-atlassian (PyPI): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77268 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-77268?
Check whether you run mcp-atlassian (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mcp-atlassian (PyPI): upgrade to 0.22.0 or later
    pip install "mcp-atlassian>=0.22.0"

Technical details

The vulnerability exists in the `_save_tokens_to_file()` method in `src/mcp_atlassian/utils/oauth.py`. Token files are created with default filesystem permissions (0644 on Linux) containing sensitive OAuth credentials including access tokens, refresh tokens, cloud IDs, and base URLs. The token directory is created with mode 0755, and the JSON file is written without explicit permission restrictions via `os.open()` with protective flags. Attack requires local system access to read the fallback token files (typically `~/.mcp-atlassian/oauth-*.json`). An attacker can immediately use the stolen access token to impersonate the victim, and use the refresh token to maintain indefinite access even after token expiration. The fix requires using `os.open()` with mode 0o600 (owner-only) and `Path.mkdir(mode=0o700)` for the directory.

Affected products

  • Atlassian MCP Atlassian <UNKNOWN>

Identifiers

  • CVE-2026-77268
  • GHSA-4596-2p6p-28cv
  • PYSEC-2026-4082

Timeline

  • 2026-09-22: disclosed
  • other: CVE-2026-77268 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.