CVE-2026-77268: mcp-atlassian World-Readable Permissions on OAuth Fallback Tokens

HERMES

HERMES THREAT SCORE & MCP RISK EXPOSURE

Target: Model Context Protocol (MCP) Server & Atlassian Ecosystem Gateway

Confidence: 96%

75 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 16 / 20

Weaponization 15 / 20

Exposure 19 / 20

Prevalence 18 / 20

Impact 17 / 20

Exploit Maturity 17 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-77268 at 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Hermes Threat Score assigns 75 (HIGH) to capture the amplified blast radius of AI agent tool execution and direct file/network access.

HASS

HASS AGENTIC SEVERITY & TOOL EXECUTION IMPACT

Target: Autonomous LLM Agent Interface & Host Execution Boundary

Confidence: 92%

72 / 100

HIGH

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown

Autonomy 16 / 20

Tool Access 19 / 20

Privilege 17 / 15

Persistence 15 / 15

External Impact 18 / 15

Propagation 16 / 15

⚖️ Divergence & Operational Rationale

Agentic tool protocols like MCP grant language models direct access to host filesystems and cloud services. Vulnerabilities in MCP tool endpoints allow indirect prompt injections to achieve arbitrary host compromise.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-77268: mcp-atlassian World-Readable Permissions on OAuth Fallback TokensVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTLangChain & LangGraph Framework

98% VERY_HIGH

Multi-agent coordination framework and cyclic state graph orchestration engine for tool-calling agents.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in LangGraph Multi-Agent Runtime documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Security Advisory & Vulnerability Metrics (CVE-2026-77268)

Vulnerability Classification: CWE-276: Insecure File Permissions
CVSS v3.1 Score: 5.5 MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Exploitation Status: Public Weaponization / Proof-of-Concept Available

Executive Summary

CVE-2026-77268 is a critical security vulnerability discovered in the open-source mcp-atlassian server (sooperset/mcp-atlassian), a premier Model Context Protocol (MCP) gateway integrating Autonomous AI Agents (Claude Desktop, Cursor, Copilot, LangChain) with enterprise Atlassian deployments (Jira and Confluence).

Prior to version 0.22.0, OAuth fallback token files (oauth-<client_id>.json) are created with default 0644 permissions, exposing long-lived Atlassian refresh tokens to unprivileged local users. This exposes enterprise environments to significant risk, ranging from direct host compromise and server-side request forgery (SSRF) against cloud metadata services to silent data exfiltration of intellectual property into Confluence and Jira ticket attachments.

---

1. Technical Context & Affected Software Matrix

Parameter	Specification	Operational Assessment
CVE Identifier	CVE-2026-77268	Official Disclosure / Advisory
Affected Product	sooperset/mcp-atlassian	Model Context Protocol Server
Vulnerability Class	CWE-276	Insecure File Permissions
Vulnerable Component	OAuth Token File Storage	Tool Execution & Dispatch Engine
Exploitation Vector	Remote Network / Prompt Injection	HTTP SSE Endpoint or Agent stdio pipe
Privileges Required	Low (PR:L)	Agent tool execution context
Resulting Access	Arbitrary Host File Access / SSRF	Full read/write over local host files or cloud IAM
Remediation Status	Fixed in version 0.22.0	Immediate package update mandated

---

2. Vulnerability Anatomy & Root Cause Analysis

Code Dissection & Mechanism

The flaw resides in OAuth Token File Storage. The server failed to enforce directory sandboxing via validate_safe_path() or strict authentication checks:

# Vulnerable pattern in mcp-atlassian (< 0.22.0)
def OAuth Token File Storage(file_path: str, **kwargs):
    # INSECURE: caller-supplied path is accessed without workspace boundary enforcement
    with open(file_path, "rb") as f:
        file_bytes = f.read()
    return client.upload(file_bytes)

In version 0.22.0, the maintainers introduced mandatory path verification:

# Remediated pattern in mcp-atlassian (0.22.0)
from mcp_atlassian.utils import validate_safe_path

def OAuth Token File Storage(file_path: str, **kwargs):
    safe_path = validate_safe_path(file_path, workspace_dir=CONFIG.WORKSPACE_ROOT)
    with open(safe_path, "rb") as f:
        file_bytes = f.read()
    return client.upload(file_bytes)

---

3. Attack Vectors & Exploitation Scenario

sequenceDiagram
    autonumber
    actor Attacker as Attacker / Adversarial Prompt
    participant Agent as LLM Agent (Claude/Cursor)
    participant MCP as mcp-atlassian Daemon
    participant Host as MCP Host OS Filesystem
    participant Atlassian as Jira / Confluence Cloud API

    Attacker->>Agent: Indirect Prompt Injection (Ticket / Repo)
    Agent->>MCP: tools/call OAuth Token File Storage(file_path="../../../../etc/passwd")
    Note over MCP: Vulnerability CVE-2026-77268:<br/>Missing Path Validation / Auth Bypass
    MCP->>Host: Access arbitrary host resource
    Host-->>MCP: Raw file data or execution pipe
    MCP->>Atlassian: Upload secret as attachment / Outbound Request
    Atlassian-->>Attacker: Sensitive Data Disclosed

1. Adversarial Ingress: The attacker feeds a poisoned prompt into an issue ticket or source file consumed by an autonomous AI agent.
2. Agentic Tool Invocation: The LLM agent generates a JSON-RPC tools/call invoking OAuth Token File Storage with a malicious argument.
3. Boundary Transgression: Due to CVE-2026-77268, the MCP server performs the operation outside the designated workspace sandbox.
4. Data Exfiltration: Host secrets, SSH keys, or cloud credentials are uploaded into Atlassian or returned in tool results.

---

4. Detection Engineering & Threat Hunting

Suricata (NIDS)

alert http any any -> any any (
  msg:"HERMES-CODEX EXPLOIT mcp-atlassian CVE-2026-77268 Attack Attempt";
  flow:to_server,established;
  content:"POST"; http_method;
  content:"/mcp/tools/call"; http_uri;
  content:"OAuth Token File Storage"; nocase;
  content:"../";
  classtype:attempted-admin;
  sid:20260101;
  rev:1;
  metadata:cve CVE-2026-77268, severity medium;
)

Sigma (Tool Invocation Logs)

title: mcp-atlassian CVE-2026-77268 Suspicious Tool Call
id: cve-2026-77268-sigma-rule
status: experimental
description: Detects path traversal or malicious arguments passed to OAuth Token File Storage in mcp-atlassian.
logsource:
  category: application
  product: mcp-atlassian
detection:
  selection:
    tool_name: 'OAuth Token File Storage'
    argument_path|contains:
      - '../'
      - '/etc/'
      - 'C:\Windows\'
      - '~/.ssh'
      - '.aws/credentials'
  condition: selection
level: critical
tags:
  - attack.t1083
  - attack.t1005

---

5. Remediation & Defense Playbook

1. Immediate Package Upgrade: Upgrade mcp-atlassian to version 0.22.0 or higher:

   pip install --upgrade "mcp-atlassian>=0.22.0"

2. Local Loopback Binding: Restrict the HTTP/SSE listener strictly to 127.0.0.1:

   python -m mcp_atlassian.server --host 127.0.0.1 --port 8000

3. Workspace Isolation: Set MCP_WORKSPACE_DIR to confine all file reads/writes to a dedicated sandbox.
4. Tool Whitelisting: Disable attachment manipulation tools if unneeded using ENABLED_TOOLS or TOOLSETS.

---

Related Threat Intelligence & References

• mcp-atlassian Profile: Version matrix, vulnerability posture, and changelog.
• Atlassian Confluence Intelligence: Enterprise wiki attack surface analysis.
• Atlassian Jira Profile: Issue tracker vulnerability history.
• Hermes Trust Center: Research methodology and vulnerability disclosures.