CVE-2026-77272: Atlassian MCP reflected XSS in OAuth setup callback handler

CVE-2026-77272 · Severity: medium · CVSS 5.4 · Published 2026-09-22

Atlassian's MCP (Model Context Protocol) tool includes an OAuth 2.0 setup wizard with a local callback server that fails to sanitize user input. An attacker can craft a malicious link containing JavaScript code that executes in a victim's browser when they are running the setup wizard, potentially allowing theft of session cookies or OAuth tokens. The callback server listens on all network interfaces, making it accessible to anyone on the victim's network during the 5-minute setup window.

Technologies: mcp-atlassian (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-77272 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77272 being exploited in the wild.
How severe is CVE-2026-77272?
Medium severity, with a CVSS score of 5.4, published 22 September 2026.
Which products and versions are affected?
mcp-atlassian (PyPI) < 0.22.0, ECOSYSTEM:introduced=0,fixed=0.22.0.
Is there a fix for CVE-2026-77272?
Yes. mcp-atlassian (PyPI): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77272 attacked?
It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-77272?
Check whether you run mcp-atlassian (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mcp-atlassian (PyPI): upgrade to 0.22.0 or later
    pip install "mcp-atlassian>=0.22.0"

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the OAuth callback handler in `src/mcp_atlassian/utils/oauth_setup.py`. The vulnerability occurs because the `error` query parameter is read from the request and injected directly into an HTML response via f-string interpolation without HTML entity encoding. The callback HTTP server binds to all network interfaces (0.0.0.0) rather than localhost, expanding the attack surface to any machine on the local network. An attacker can deliver a crafted callback URL containing JavaScript (e.g., `http://victim-ip:8080/callback?error=<script>alert('xss')</script>`) which executes when the victim clicks the link. The server runs for up to 300 seconds during the OAuth setup flow, providing a meaningful exploitation window. The response also lacks security headers (CSP, X-Content-Type-Options, X-XSS-Protection) that might mitigate the attack.

Affected products

  • Atlassian MCP <UNKNOWN>

Identifiers

  • CVE-2026-77272
  • GHSA-g2r2-3j32-j27x
  • PYSEC-2026-4093

Timeline

  • 2026-09-22: disclosed
  • other: CVE-2026-77272 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.