PyPI - OSV

PYSEC-2026-4088

PyPI/mcp-atlassian

MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path() 3 days ago

Fix available
Severity - 7.7 (High)

PYSEC-2026-4094

PyPI/mcp-atlassian

MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions 3 days ago

Fix available
Severity - 6.1 (Medium)

PYSEC-2026-4100

PyPI/mcp-atlassian

MCP Atlassian: Incomplete fix for GHSA-7r34-79r5-rcc9: redirect-based SSRF via unhooked requests session in Jira user-permission lookup 3 days ago

Fix available
Severity - 5.3 (Medium)

PYSEC-2026-4092

PyPI/mcp-atlassian

MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters 3 days ago

Fix available

PYSEC-2026-4103

PyPI/mcp-atlassian

[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token 3 days ago

Fix available
Severity - 10.0 (Critical)

PYSEC-2026-4096

PyPI/mcp-atlassian

MCP Atlassian: SSRF Protection Bypass 3 days ago

Fix available
Severity - 8.8 (High)

PYSEC-2026-4087

PyPI/mcp-atlassian

MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4) 3 days ago

Fix available
Severity - 8.3 (High)

PYSEC-2026-4084

PyPI/mcp-atlassian

mcp-atlassian has an incomplete SSRF remediation 3 days ago

Fix available
Severity - 8.3 (High)

PYSEC-2026-4093

PyPI/mcp-atlassian

MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler 3 days ago

Fix available
Severity - 5.4 (Medium)

PYSEC-2026-4099

PyPI/mcp-atlassian

MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4) 3 days ago

Fix available
Severity - 8.6 (High)

PYSEC-2026-4082

PyPI/mcp-atlassian

MCP Atlassian: Insecure File Permissions on OAuth Token Storage 3 days ago

Fix available
Severity - 5.5 (Medium)

PYSEC-2026-4086

PyPI/mcp-atlassian

MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials 3 days ago

Fix available
Severity - 7.7 (High)

PYSEC-2026-4085

PyPI/mcp-atlassian

MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches 3 days ago

Fix available
Severity - 7.1 (High)

PYSEC-2026-4090

PyPI/mcp-atlassian

MCP Atlassian: Arbitrary File Read via Upload Attachment Tools 3 days ago

Fix available
Severity - 6.5 (Medium)

PYSEC-2026-4083

PyPI/mcp-atlassian

MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow 3 days ago

Fix available
Severity - 5.9 (Medium)

PYSEC-2026-4097

PyPI/mcp-atlassian

MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call 3 days ago

Fix available
Severity - 6.5 (Medium)

Vulnerabilities