Technology · PyPI
mcp-atlassian (PyPI) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 30 vulnerabilities in mcp-atlassian (PyPI): 0 in the last 7 days and 27 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-77272, was published on 22 September 2026. Nothing in the last four weeks, down from 27 vulnerabilities in the four before. 0 critical against 1.
- Last 7 days
- 0
- Last 90 days
- 27
- Critical, all time
- 1
- Exploited in the wild
- 0
About mcp-atlassian (PyPI)
A Python package providing integration for Atlassian products.
Latest mcp-atlassian (PyPI) vulnerabilities
- CVE-2026-77272: Atlassian MCP reflected XSS in OAuth setup callback handlermediumCVSS 5.4EPSS 0.3%
- CVE-2026-77269: Atlassian MCP path traversal in upload_attachment allows arbitrary file readmediumCVSS 6.5EPSS 0.4%
- CVE-2026-77268: Atlassian MCP insecure OAuth token file permissionsmediumCVSS 5.5EPSS 0.1%
- CVE-2026-77266: MCP Atlassian path traversal in upload_attachmentmediumCVSS 6.5EPSS 0.4%
- CVE-2026-77262: sooperset mcp-atlassian path traversal in confluence_upload_attachmenthighCVSS 8.6EPSS 0.5%
- CVE-2026-77259: MCP Atlassian arbitrary file read via confluence_upload_attachmenthighCVSS 7.7EPSS 0.4%
- CVE-2026-77257: sooperset mcp-atlassian arbitrary local file read in HTTP uploadhighCVSS 4EPSS 0.4%
- CVE-2026-77255: Atlassian MCP arbitrary file read via path traversal in update_issuehighCVSS 8.6EPSS 0.4%
- CVE-2026-77253: MCP Atlassian arbitrary file read in attachment uploadhighCVSS 7.1EPSS 0.4%
- CVE-2026-77249: Atlassian MCP Jira user-permission lookup SSRF via unvalidated request sessionmediumCVSS 5.3EPSS 0.3%
- CVE-2026-77248: Atlassian MCP unauthenticated arbitrary file read in upload_attachmenthighCVSS 8.6EPSS 0.4%
- CVE-2026-77247: Sooperset MCP Atlassian arbitrary file upload to Jira/Confluence via unrestricted file pathshighCVSS 7.5EPSS 0.4%
- CVE-2026-77246: MCP Atlassian HTTP server local file exfiltration via unvalidated attachment pathhighCVSS 7.4EPSS 0.4%
- CVE-2026-77274: Atlassian MCP SSRF protection bypass via URL parser mismatchhighCVSS 4EPSS 0.3%
- CVE-2026-77271: Atlassian MCP path traversal bypass leading to RCEhighCVSS 4EPSS 0.5%
- CVE-2026-77270: Atlassian MCP arbitrary file read via upload attachment toolsmediumCVSS 6.5EPSS 0.4%
- CVE-2026-77267: mcp-atlassian incomplete SSRF remediation in URL header processinghighCVSS 4EPSS 0.3%
- CVE-2026-77265: Atlassian MCP Server SSRF via DNS rebinding in header authenticationmediumCVSS 5.9EPSS 0.3%
- CVE-2026-77261: MCP Atlassian SSRF protection bypass in basic-auth and OAuth brancheshighCVSS 7.1EPSS 0.3%
- CVE-2026-77260: Atlassian MCP Server arbitrary file read via unconstrained upload_attachment pathhighCVSS 4EPSS 0.4%
- CVE-2026-77258: MCP Atlassian path traversal in attachment uploadhighCVSS 7.7EPSS 0.3%
- CVE-2026-77251: mcp-atlassian JQL/CQL filter bypass in Jira and Confluence searchhighCVSS 4EPSS 0.2%
- CVE-2026-77250: MCP Atlassian OAuth fallback token storage plaintext exposuremediumCVSS 6.1EPSS 0.1%
- CVE-2026-77244: mcp-atlassian authentication bypass in HTTP transportcriticalCVSS 10EPSS 0.3%
- CVE-2026-77243: mcp-atlassian tool authorization bypass in tools/callhighCVSS 8.8EPSS 0.3%
Most severe mcp-atlassian (PyPI) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-77244: mcp-atlassian authentication bypass in HTTP transportcriticalCVSS 10EPSS 0.3%
- CVE-2026-77243: mcp-atlassian tool authorization bypass in tools/callhighCVSS 8.8EPSS 0.3%
- CVE-2026-77262: sooperset mcp-atlassian path traversal in confluence_upload_attachmenthighCVSS 8.6EPSS 0.5%
- CVE-2026-77255: Atlassian MCP arbitrary file read via path traversal in update_issuehighCVSS 8.6EPSS 0.4%
- CVE-2026-77248: Atlassian MCP unauthenticated arbitrary file read in upload_attachmenthighCVSS 8.6EPSS 0.4%
- CVE-2026-73496: MCP Atlassian path traversal in attachment uploadhighCVSS 7.7EPSS 0.5%
- CVE-2026-73498: MCP Atlassian arbitrary file read in attachment uploadhighCVSS 7.7EPSS 0.5%
- CVE-2026-77259: MCP Atlassian arbitrary file read via confluence_upload_attachmenthighCVSS 7.7EPSS 0.4%
- CVE-2026-77258: MCP Atlassian path traversal in attachment uploadhighCVSS 7.7EPSS 0.3%
- CVE-2026-77247: Sooperset MCP Atlassian arbitrary file upload to Jira/Confluence via unrestricted file pathshighCVSS 7.5EPSS 0.4%
Vulnerabilities per week
Nothing in the last four weeks, down from 27 vulnerabilities in the four before. 0 critical against 1. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 2 | 0 | |
| 21 Sep 2026 | 25 | 1 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many mcp-atlassian (PyPI) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/mcp-atlassian)<a href="https://junglewise.ai/threats/technologies/mcp-atlassian"><img src="https://junglewise.ai/threats/technologies/mcp-atlassian/badge.svg" alt="mcp-atlassian (PyPI) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/mcp-atlassian.json, and this page as text at https://junglewise.ai/threats/technologies/mcp-atlassian.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "mcp-atlassian (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/mcp-atlassian, 13 November 2026.