Local File Permission Exposure in MCP Atlassian for Confluence and Jira

CVE-2026-77256

What is CVE-2026-77256?

MCP Atlassian, a Model Context Protocol server used for Atlassian products such as Confluence and Jira, contains a vulnerability where the OAuth fallback file that stores access and refresh tokens is saved with insufficient permissions due to being influenced by the process umask. As a result, if not properly secured, local users may gain unauthorized access to these tokens, allowing them to impersonate legitimate users within Atlassian applications. This vulnerability, addressed in version 0.22.0, underscores the importance of stringent permission settings to safeguard sensitive information.

References