Is mcp-atlassian safe?
30 fixed advisories Facts from the mcp-audit registry about the pypi package mcp-atlassian. The same data is served as JSON.
Check it from your terminal
mcp-audit vet mcp-atlassian --ecosystem pypiOffline: it uses the registry bundled with mcp-audit. mcp-audit update-registry fetches the newest one.
Registry facts
| Maintainer | community |
|---|---|
| Verified publisher | no |
| Entry last checked | 2026-10-11 |
| Hash pins | none recorded |
| Provenance expected | no |
| Repository | https://github.com/sooperset/mcp-atlassian |
Recorded advisories 30
| Advisory | CVSS | Summary | Fixed in |
|---|---|---|---|
| CVE-2026-27826 | not recorded | SSRF: unauthenticated callers can make the server request arbitrary URLs through the Jira/Confluence URL headers. | 0.17.0 |
| CVE-2026-73498 | not recorded | confluence_upload_attachment opens a caller-supplied file_path with no path validation (arbitrary file read). | 0.22.0 |
| CVE-2026-77243 | not recorded | ENABLED_TOOLS / TOOLSETS filters are enforced only at tools/list time, so filtered tools stay callable. | 0.22.0 |
| CVE-2026-77244 | not recorded | Auth bypass in the HTTP transport: any non-empty token is accepted, exposing the operator's credentials. | 0.22.0 |
| CVE-2026-77246 | not recorded | Attachment upload tools open arbitrary server-side paths, enabling local file exfiltration. | 0.22.0 |
| CVE-2026-77247 | not recorded | Jira and Confluence upload tools read caller-controlled local paths before uploading them. | 0.22.0 |
| CVE-2026-77248 | not recorded | Unauthenticated local file read via upload_attachment in the multi-user streamable-HTTP deployment. | 0.22.0 |
| CVE-2026-77249 | not recorded | Incomplete fix for CVE-2026-27826: SSRF via redirects in the Jira permission lookup. | 0.22.0 |
| CVE-2026-77250 | not recorded | OAuth tokens are always written to a plaintext fallback file under ~/.mcp-atlassian/. | 0.22.0 |
| CVE-2026-77251 | not recorded | Filter settings allow access to Jira/Confluence content that should be forbidden. | 0.22.0 |
| CVE-2026-77253 | not recorded | Jira and Confluence upload tools upload arbitrary local files to Atlassian. | 0.22.0 |
| CVE-2026-77255 | not recorded | Confused deputy: Jira update_issue can read and exfiltrate arbitrary host files. | 0.22.0 |
| CVE-2026-77258 | not recorded | Confluence upload_attachment reads and uploads local files without validate_safe_path(). | 0.22.0 |
| CVE-2026-77259 | not recorded | Missing path validation in confluence_upload_attachment lets clients read and exfiltrate server files. | 0.22.0 |
| CVE-2026-77260 | not recorded | Arbitrary local file read via file_path in the Jira and Confluence upload tools. | 0.22.0 |
| CVE-2026-77261 | not recorded | SSRF redirect protection is missing in the basic-auth and OAuth branches. | 0.22.0 |
| CVE-2026-77265 | not recorded | SSRF protection for header-based auth is vulnerable to DNS rebinding (validate-then-use). | 0.22.0 |
| CVE-2026-77266 | not recorded | Jira and Confluence upload_attachment open user-controlled paths without validate_safe_path(). | 0.22.0 |
| CVE-2026-77267 | not recorded | Incomplete SSRF remediation: X-Atlassian-*-Url headers reach API clients without SSRF validation. | 0.22.0 |
| CVE-2026-77268 | not recorded | OAuth token files are created with default (group-readable) permissions. | 0.22.0 |
| CVE-2026-77269 | not recorded | Path traversal in confluence_upload_attachment(s); incomplete fix for CVE-2026-27825. | 0.22.0 |
| CVE-2026-77271 | not recorded | Incomplete path traversal fix allows module overwrite and code execution. | 0.22.0 |
| CVE-2026-77272 | not recorded | Reflected XSS in the OAuth setup wizard's local callback server. | 0.22.0 |
| CVE-2026-77274 | not recorded | SSRF protection bypass in validate_url_for_ssrf() on the header-based auth flow. | 0.22.0 |
| CVE-2026-27825 | not recorded | MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment | 0.17.0 |
| CVE-2026-73496 | not recorded | mcp-atlassian: Arbitrary server-side file read via attachment upload | 0.22.0 |
| CVE-2026-73497 | not recorded | MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826) | 0.22.0 |
| CVE-2026-77257 | not recorded | MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths | 0.22.0 |
| CVE-2026-77262 | not recorded | MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4) | 0.22.0 |
| CVE-2026-77270 | not recorded | MCP Atlassian: Arbitrary File Read via Upload Attachment Tools | 0.22.0 |
Advisories with no recorded fix are listed first. CVE IDs link to NVD, GHSA IDs to GitHub and other IDs to OSV. A fixed advisory affects only versions below its fix; vet exits 1 only for advisories with no fix.
What it can do
- It can read files on your machine.
- It can write or modify files on your machine.
- It can make outbound network requests.
Capability tags come from the registry. mcp-audit uses them to find dangerous combinations with your other servers.
Check how you run it
This page describes the public package. What matters is your setup: which version you pin, which secrets you pass, and which other servers sit next to it.
mcp-audit checkBadge for your README
mcp-audit30 fixed CVEs
Preview drawn by this page. The real badge is rendered by shields.io from this JSON and updates when the registry does.
[](https://mcp-audit.dev/servers/pypi/mcp-atlassian/)