CVE-2026-77268: MCP Atlassian Information Disclosure Flaw

CVE-2026-77268 Overview

MCP Atlassian is a Model Context Protocol (MCP) server that bridges AI assistants with Atlassian products including Confluence and Jira. Versions prior to 0.22.0 create the OAuth fallback token directory and JSON file without explicit owner-only permission modes. Local users or processes that inherit group or world permission bits can read the stored access and refresh tokens. An attacker with local access can reuse the associated Atlassian session and impersonate the legitimate user against Confluence or Jira. The issue is tracked as [CWE-732: Incorrect Permission Assignment for Critical Resource] and is fixed in version 0.22.0.

Critical Impact
Local users with filesystem read access to ~/.mcp-atlassian/oauth-<client_id>.json can steal OAuth access_token and refresh_token values and hijack the Atlassian session.

Affected Products

MCP Atlassian (sooperset/mcp-atlassian) versions prior to 0.22.0
Deployments using the OAuth fallback token storage under ~/.mcp-atlassian
Multi-user hosts where the MCP Atlassian server runs under a shared account

Discovery Timeline

2026-09-22 - CVE-2026-77268 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77268

Vulnerability Analysis

MCP Atlassian persists OAuth credentials to disk to support token refresh across process restarts. Prior to version 0.22.0, the server created the ~/.mcp-atlassian directory and the oauth-<client_id>.json file relying on the process umask rather than enforcing explicit owner-only modes. On typical Linux and macOS systems, this leaves group or world read bits enabled depending on the inherited umask. Any local user or process with matching permissions can read the file and extract the access_token and refresh_token fields. The exposure is limited to confidentiality of local credentials but is high impact because the tokens grant full delegated access to the linked Atlassian tenant.

Root Cause

The root cause is [CWE-732: Incorrect Permission Assignment for Critical Resource]. The OAuth fallback storage code path did not call os.chmod with 0o600 on the token file or 0o700 on the containing directory. File modes were therefore determined by the ambient umask, which does not guarantee owner-only access.

Attack Vector

Exploitation requires local access on the host running MCP Atlassian and the ability to read files owned by the server account. An attacker reads ~/.mcp-atlassian/oauth-<client_id>.json, extracts the token material, and replays it against the Atlassian Cloud APIs. No user interaction is required, and no network path to the target is needed beyond the attacker's own connection to Atlassian.

text

# Illustrative file layout referenced in the advisory
~/.mcp-atlassian/
└── oauth-<client_id>.json   # contains access_token and refresh_token

See the GitHub Security Advisory GHSA-4596-2p6p-28cv for the vendor description of the affected entry points and code paths.

Detection Methods for CVE-2026-77268

Indicators of Compromise

Presence of ~/.mcp-atlassian/oauth-<client_id>.json with group or world read bits set (any mode other than 0600).
The parent directory ~/.mcp-atlassian with permissions broader than 0700.
Unexpected read access events on the OAuth token file by users other than the MCP Atlassian service account.
Atlassian audit log entries showing API activity from unexpected IP addresses that reuse a still-valid refresh token.

Detection Strategies

Enumerate hosts running MCP Atlassian and audit stat -c '%a %U %G %n' ~/.mcp-atlassian/* for permissions weaker than 600.
Monitor Linux audit rules (auditctl -w /home/*/.mcp-atlassian -p r) for read access by non-owner UIDs.
Correlate Atlassian Cloud audit events with authorized MCP server hosts to identify token replay from unexpected sources.

Monitoring Recommendations

Enable Atlassian Cloud audit log forwarding and alert on OAuth token use from new user agents or geographies.
Track file integrity and permission changes under ~/.mcp-atlassian using host-based monitoring.
Review the MCP Atlassian version in use across build and deployment inventories to confirm 0.22.0 or later.

How to Mitigate CVE-2026-77268

Immediate Actions Required

Upgrade MCP Atlassian to version 0.22.0 or later, published as GitHub Release v0.22.0.
Revoke and rotate any OAuth client credentials whose tokens were stored on multi-user hosts prior to upgrade.
Restrict permissions on existing token files: chmod 700 ~/.mcp-atlassian && chmod 600 ~/.mcp-atlassian/oauth-*.json.

Patch Information

The fix is included in the security hardening commit b041733 and released as version 0.22.0. Design discussion is available in Pull Request #1448. The patch enforces explicit owner-only modes when creating the OAuth fallback directory and JSON file and adds broader security regression coverage.

Workarounds

Run the MCP Atlassian server under a dedicated, unprivileged account isolated from other users on the host.
Set a restrictive umask 0077 in the service environment so newly created files default to owner-only access.
Store OAuth secrets in an external secret manager rather than relying on the on-disk fallback where feasible.

bash

# Configuration example: enforce owner-only access on existing artifacts
umask 0077
chmod 700 ~/.mcp-atlassian
chmod 600 ~/.mcp-atlassian/oauth-*.json
stat -c '%a %n' ~/.mcp-atlassian ~/.mcp-atlassian/oauth-*.json