CVE-2026-77268: MCP Atlassian: Insecure File Permissions on OAuth Token Storage
The OAuth token fallback file storage in OAuthConfig._save_tokens_to_file() creates token files containing access tokens, refresh tokens, and cloud IDs with default filesystem permissions (typically 0644 on Linux, world-readable). Any local user on a shared system can read these files to obtain full Atlassian API credentials, enabling unauthorized access to the victim’s Jira and Confluence data.
References
- github.com/advisories/GHSA-4596-2p6p-28cv
- github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460
- github.com/sooperset/mcp-atlassian/pull/1448
- github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0
- github.com/sooperset/mcp-atlassian/security/advisories/GHSA-4596-2p6p-28cv
- nvd.nist.gov/vuln/detail/CVE-2026-77268
Code Behaviors & Features
Detect and mitigate CVE-2026-77268 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →