PT-2026-22386 · Unknown · Mcp-Attlasian

Gil-Maman-P + 1 · Published 2026-02-27 · Updated 2026-04-22 · CVE-2026-27825

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mcp-atlassian (affected versions not specified)

Description The software contains a critical unauthenticated remote code execution (RCE) and server-side request forgery (SSRF) issue. The RCE is a result of arbitrary file write, leading to arbitrary code execution via an unconstrained download path in the confluence download attachment function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Path traversal

Weakness Enumeration

CWE-73

CWE-22

Related Identifiers

CVE-2026-27825

GHSA-XJGW-4WVW-RGM4

Affected Products

Mcp-Attlasian

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27825.json · Exploit
• https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-xjgw-4wvw-rgm4 · Vendor Advisory
• https://github.com/sooperset/mcp-atlassian/commit/52b9b0997681e87244b20d58034deae89c91631e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27825 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27825 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xjgw-4wvw-rgm4 · Vendor Advisory
• https://github.com/sooperset/mcp-atlassian · Note
• https://twitter.com/HermeticSys/status/2046914421365354947 · Twitter Post
• https://twitter.com/0dayPublishing/status/2031451098951688251 · Twitter Post
• https://twitter.com/CveFindCom/status/2031470522576290140 · Twitter Post
• https://reddit.com/r/tellerstech/comments/1rn18ls/ship_it_weekly_podcast_aws_bahrainuae_data_center · Reddit Post
• https://twitter.com/ChannelSkell/status/2034348164359106599 · Twitter Post
• https://twitter.com/guava_asi/status/2028966602591670702 · Twitter Post
• https://twitter.com/vulert_official/status/2031732584544395399 · Twitter Post
• https://twitter.com/CVEnew/status/2031504155043405893 · Twitter Post