CVE-2026-77256: MCP Atlassian Information Disclosure Flaw

CVE-2026-77256 Overview

CVE-2026-77256 affects MCP Atlassian, a Model Context Protocol (MCP) server that bridges AI assistants with Atlassian Confluence and Jira. Versions prior to 0.22.0 write the plaintext OAuth fallback file containing refresh and access tokens using permissions inherited from the process umask. Under common or permissive host configurations, other local users can read the file and retain persistent Atlassian access through the stored refresh token. The weakness maps to [CWE-732: Incorrect Permission Assignment for Critical Resource]. Maintainers fixed the issue in version 0.22.0.

Critical Impact
Local users on the same host can read plaintext OAuth refresh and access tokens, enabling persistent unauthorized access to Confluence and Jira tenants.

Affected Products

MCP Atlassian versions prior to 0.22.0
Deployments using the OAuth fallback token file storage path
Multi-tenant or shared hosts running MCP Atlassian under permissive umask settings

Discovery Timeline

2026-09-22 - CVE-2026-77256 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77256

Vulnerability Analysis

MCP Atlassian persists OAuth credentials to a local fallback file when in-memory or system keychain storage is unavailable. The OAuthConfig._save_tokens_to_file routine writes the file without explicitly restricting mode bits, so the resulting permissions depend entirely on the calling process umask. On many Linux and container images, the default umask of 022 yields world-readable files (0644).

The stored payload contains both the short-lived access_token and the long-lived refresh_token. An attacker with an unprivileged local account can read the file, exfiltrate the tokens, and mint new access tokens through the Atlassian OAuth endpoint. This survives service restarts and credential rotation until the refresh token is explicitly revoked.

Root Cause

The root cause is missing permission hardening at file-creation time. The code path relied on ambient process state (umask) instead of enforcing owner-only access with an explicit mode such as 0600, or opening the file with os.O_CREAT | os.O_WRONLY and mode=0o600. The advisory identifies OAuthConfig._save_tokens_to_file, refresh_token, access_token, and umask as the affected entry points and code paths.

Attack Vector

Exploitation requires local read access on the host running MCP Atlassian. On shared workstations, multi-tenant build hosts, or containers where multiple service accounts share a filesystem, any account with directory traversal rights can read the token file. Because the refresh token is long-lived, the attacker retains Confluence and Jira access even after the MCP process is stopped or the OAuth session appears idle.

python

# Patch context from the v0.22.0 hardening (illustrative excerpt)
# Source: https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460

# Confine the upload source to the workspace before it is read: reject
# traversal/absolute paths that escape CWD (arbitrary file read /
# exfiltration via a caller-supplied file_path).
file_path = str(validate_safe_path(file_path))

# Check if file exists
if not os.path.exists(file_path):
    return {"success": False, "error": "File not found"}

Source: GitHub Commit b041733

Detection Methods for CVE-2026-77256

Indicators of Compromise

Presence of the MCP Atlassian OAuth token file with mode bits broader than 0600 (for example 0644 or 0664).
Atlassian audit log entries showing token refresh events from unexpected IP addresses or user agents.
New Confluence or Jira API sessions correlated with local file reads on the MCP host by non-owner accounts.

Detection Strategies

Audit filesystem permissions on OAuth token cache paths used by MCP Atlassian and flag any file readable by group or other.
Enable Atlassian Cloud audit logging and alert on refresh-token grants originating outside sanctioned MCP host IP ranges.
Inventory installed MCP Atlassian versions across development hosts and CI runners; treat any version below 0.22.0 as vulnerable.

Monitoring Recommendations

Monitor open() and read() syscalls against the token file path using Linux auditd or eBPF instrumentation.
Track Atlassian OAuth token issuance frequency per client and alert on anomalies that suggest stolen refresh-token reuse.
Review shell history and process accounting for local users accessing MCP configuration directories.

How to Mitigate CVE-2026-77256

Immediate Actions Required

Upgrade MCP Atlassian to version 0.22.0 or later on every host and container image.
Revoke all existing Atlassian OAuth refresh tokens issued to MCP Atlassian clients and re-authenticate to force new credential issuance.
Restrict the token file to owner-only access (chmod 600) and confirm the parent directory is not world-traversable.
Audit shared hosts for unauthorized reads of the previous token file and rotate any Atlassian API credentials that may have been exposed.

Patch Information

The fix is available in MCP Atlassian v0.22.0. Additional context is available in the GitHub Security Advisory GHSA-76pr-5669-3xf5 and the associated pull request discussion.

Workarounds

Run MCP Atlassian under a dedicated service account with a restrictive umask of 077 before the process starts.
Store the token file on a filesystem path that only the service account can traverse, such as a private subdirectory of the account home.
Where possible, disable the plaintext OAuth fallback and rely on OS-provided credential storage until the upgrade is deployed.

bash

# Configuration example: enforce owner-only permissions before starting MCP Atlassian
umask 077
chmod 700 /var/lib/mcp-atlassian
chmod 600 /var/lib/mcp-atlassian/oauth_tokens.json
systemctl restart mcp-atlassian