PyPI - OSV

PYSEC-2026-3683

PyPI/mcp-atlassian

mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment 19 Aug

Fix available
Severity - 7.7 (High)

PYSEC-2026-2621

PyPI/mcp-atlassian

MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers 13 Jul

Fix available
Severity - 8.2 (High)

GHSA-g5r6-gv6m-f5jv

PyPI/mcp-atlassian

mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment 10 Jul

Fix available
Severity - 7.7 (High)

GHSA-wm45-qh3g-v83f

PyPI/mcp-atlassian

mcp-atlassian: Arbitrary server-side file read via attachment upload 10 Jul

Fix available
Severity - 7.7 (High)

GHSA-489g-7rxv-6c8q

PyPI/mcp-atlassian

MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826) 10 Jul

Fix available
Severity - 6.5 (Medium)

PYSEC-2026-408

PyPI/mcp-atlassian

MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment 29 Jun

Fix available
Severity - 9.0 (Critical)

GHSA-xjgw-4wvw-rgm4

PyPI/mcp-atlassian

MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment 10 Mar

Fix available
Severity - 9.0 (Critical)

GHSA-7r34-79r5-rcc9

PyPI/mcp-atlassian

MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers 10 Mar

Fix available
Severity - 8.2 (High)

Vulnerabilities