Vulnerability-Lookup

GHSA-4596-2P6P-28CV

Vulnerability from github – Published: 2026-09-22 20:35 – Updated: 2026-09-22 20:35

Summary

MCP Atlassian: Insecure File Permissions on OAuth Token Storage

Details

Summary

The OAuth token fallback file storage in OAuthConfig._save_tokens_to_file() creates token files containing access tokens, refresh tokens, and cloud IDs with default filesystem permissions (typically 0644 on Linux, world-readable). Any local user on a shared system can read these files to obtain full Atlassian API credentials, enabling unauthorized access to the victim's Jira and Confluence data.

Details

The vulnerability exists in src/mcp_atlassian/utils/oauth.py in the _save_tokens_to_file method.

Step 1 -- Directory created without restrictive permissions:

At line 402-403, the token directory is created with mkdir(exist_ok=True) which uses the default umask (typically creating directories with mode 0755):

# src/mcp_atlassian/utils/oauth.py:402-403
token_dir = Path.home() / ".mcp-atlassian"
token_dir.mkdir(exist_ok=True)

Step 2 -- Token file written with default permissions:

At line 417-418, the token file containing sensitive credentials is written using open() with no explicit mode, inheriting default umask permissions (typically 0644 on Linux):

# src/mcp_atlassian/utils/oauth.py:406-418
token_path = token_dir / f"oauth-{self.client_id}.json"

if token_data is None:
    token_data = {
        "refresh_token": self.refresh_token,
        "access_token": self.access_token,
        "expires_at": self.expires_at,
        "cloud_id": self.cloud_id,
        "base_url": self.base_url,
    }

with open(token_path, "w") as f:
    json.dump(token_data, f)

Step 3 -- The file contains full API credentials:

The token file contains: - access_token: A valid OAuth access token for the Atlassian API - refresh_token: Can be exchanged for new access tokens indefinitely - cloud_id: Identifies the target Atlassian Cloud instance - base_url: The target Data Center instance URL

No os.chmod or os.fchmod is called anywhere after file creation.

The primary storage via keyring (line 373) is secure, but the fallback file storage at line 386 is always written in addition to keyring (line 386: self._save_tokens_to_file(token_data)). When keyring fails (common in headless/container/CI environments), the fallback becomes the only storage.

PoC

# Step 1: Victim runs mcp-atlassian with OAuth and completes the flow.
# This creates the token file.

# Step 2: As any other user on the same system, read the token file:
cat /home/victim/.mcp-atlassian/oauth-*.json

# Expected output (sensitive credentials in plaintext):
# {"refresh_token": "eyJ...", "access_token": "eyJ...", "expires_at": 1741234567.0, "cloud_id": "abc-123", "base_url": null}

# Step 3: Verify the token works:
curl -H "Authorization: Bearer <stolen_access_token>" \
  "https://api.atlassian.com/ex/jira/<stolen_cloud_id>/rest/api/3/myself"

# Step 4: Use the refresh token to get a new access token:
curl -X POST "https://auth.atlassian.com/oauth/token" \
  -d "grant_type=refresh_token" \
  -d "client_id=<from_env>" \
  -d "client_secret=<from_env>" \
  -d "refresh_token=<stolen_refresh_token>"

Verify file permissions (on Linux/macOS):

ls -la ~/.mcp-atlassian/
# drwxr-xr-x  2 user user 4096 Mar 10 12:00 .
# -rw-r--r--  1 user user  256 Mar 10 12:00 oauth-abc123.json
#                ^^ ^^ ^^
#                world-readable!

Impact

Credential theft: Any local user can read the OAuth tokens and impersonate the victim on their Atlassian Cloud/Data Center instance.
Persistent access: The refresh token allows the attacker to generate new access tokens indefinitely, even after the original access token expires.
Full API access: The stolen tokens grant the same API permissions as the victim, including reading/writing Jira issues, Confluence pages, and potentially sensitive project data.
Affected environments: Shared servers, CI/CD runners, multi-user workstations, and containerized deployments where the fallback file storage is used (keyring unavailable).

Recommended Fix

1. Set restrictive permissions on the directory and file:

# src/mcp_atlassian/utils/oauth.py

import os
import stat

def _save_tokens_to_file(self, token_data: dict | None = None) -> None:
    """Save the tokens to a file as fallback storage."""
    try:
        token_dir = Path.home() / ".mcp-atlassian"
        token_dir.mkdir(exist_ok=True, mode=0o700)

        token_path = token_dir / f"oauth-{self.client_id}.json"

        if token_data is None:
            token_data = {
                "refresh_token": self.refresh_token,
                "access_token": self.access_token,
                "expires_at": self.expires_at,
                "cloud_id": self.cloud_id,
                "base_url": self.base_url,
            }

        # Open with restrictive permissions (owner-only read/write)
        fd = os.open(
            str(token_path),
            os.O_WRONLY | os.O_CREAT | os.O_TRUNC,
            stat.S_IRUSR | stat.S_IWUSR,  # 0o600
        )
        try:
            with os.fdopen(fd, "w") as f:
                json.dump(token_data, f)
        except Exception:
            os.close(fd)
            raise

        logger.debug(f"Saved OAuth tokens to file {token_path} (fallback storage)")
    except Exception as e:
        logger.error(f"Failed to save tokens to file: {e}")

2. Additionally, fix the directory permissions for existing installations:

# In __init__ or from_env, ensure existing directories are tightened
token_dir = Path.home() / ".mcp-atlassian"
if token_dir.exists():
    os.chmod(str(token_dir), 0o700)

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mcp-atlassian"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.22.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77268"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-732"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T20:35:19Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe OAuth token fallback file storage in `OAuthConfig._save_tokens_to_file()` creates token files containing access tokens, refresh tokens, and cloud IDs with default filesystem permissions (typically `0644` on Linux, world-readable). Any local user on a shared system can read these files to obtain full Atlassian API credentials, enabling unauthorized access to the victim\u0027s Jira and Confluence data.\n\n## Details\n\nThe vulnerability exists in `src/mcp_atlassian/utils/oauth.py` in the `_save_tokens_to_file` method.\n\n**Step 1 -- Directory created without restrictive permissions:**\n\nAt line 402-403, the token directory is created with `mkdir(exist_ok=True)` which uses the default umask (typically creating directories with mode `0755`):\n\n```python\n# src/mcp_atlassian/utils/oauth.py:402-403\ntoken_dir = Path.home() / \".mcp-atlassian\"\ntoken_dir.mkdir(exist_ok=True)\n```\n\n**Step 2 -- Token file written with default permissions:**\n\nAt line 417-418, the token file containing sensitive credentials is written using `open()` with no explicit mode, inheriting default umask permissions (typically `0644` on Linux):\n\n```python\n# src/mcp_atlassian/utils/oauth.py:406-418\ntoken_path = token_dir / f\"oauth-{self.client_id}.json\"\n\nif token_data is None:\n    token_data = {\n        \"refresh_token\": self.refresh_token,\n        \"access_token\": self.access_token,\n        \"expires_at\": self.expires_at,\n        \"cloud_id\": self.cloud_id,\n        \"base_url\": self.base_url,\n    }\n\nwith open(token_path, \"w\") as f:\n    json.dump(token_data, f)\n```\n\n**Step 3 -- The file contains full API credentials:**\n\nThe token file contains:\n- `access_token`: A valid OAuth access token for the Atlassian API\n- `refresh_token`: Can be exchanged for new access tokens indefinitely\n- `cloud_id`: Identifies the target Atlassian Cloud instance\n- `base_url`: The target Data Center instance URL\n\n**No `os.chmod` or `os.fchmod` is called** anywhere after file creation.\n\nThe primary storage via `keyring` (line 373) is secure, but the fallback file storage at line 386 is always written in addition to keyring (line 386: `self._save_tokens_to_file(token_data)`). When keyring fails (common in headless/container/CI environments), the fallback becomes the only storage.\n\n## PoC\n\n```bash\n# Step 1: Victim runs mcp-atlassian with OAuth and completes the flow.\n# This creates the token file.\n\n# Step 2: As any other user on the same system, read the token file:\ncat /home/victim/.mcp-atlassian/oauth-*.json\n\n# Expected output (sensitive credentials in plaintext):\n# {\"refresh_token\": \"eyJ...\", \"access_token\": \"eyJ...\", \"expires_at\": 1741234567.0, \"cloud_id\": \"abc-123\", \"base_url\": null}\n\n# Step 3: Verify the token works:\ncurl -H \"Authorization: Bearer \u003cstolen_access_token\u003e\" \\\n  \"https://api.atlassian.com/ex/jira/\u003cstolen_cloud_id\u003e/rest/api/3/myself\"\n\n# Step 4: Use the refresh token to get a new access token:\ncurl -X POST \"https://auth.atlassian.com/oauth/token\" \\\n  -d \"grant_type=refresh_token\" \\\n  -d \"client_id=\u003cfrom_env\u003e\" \\\n  -d \"client_secret=\u003cfrom_env\u003e\" \\\n  -d \"refresh_token=\u003cstolen_refresh_token\u003e\"\n```\n\n**Verify file permissions (on Linux/macOS):**\n\n```bash\nls -la ~/.mcp-atlassian/\n# drwxr-xr-x  2 user user 4096 Mar 10 12:00 .\n# -rw-r--r--  1 user user  256 Mar 10 12:00 oauth-abc123.json\n#                ^^ ^^ ^^\n#                world-readable!\n```\n\n## Impact\n\n- **Credential theft**: Any local user can read the OAuth tokens and impersonate the victim on their Atlassian Cloud/Data Center instance.\n- **Persistent access**: The refresh token allows the attacker to generate new access tokens indefinitely, even after the original access token expires.\n- **Full API access**: The stolen tokens grant the same API permissions as the victim, including reading/writing Jira issues, Confluence pages, and potentially sensitive project data.\n- **Affected environments**: Shared servers, CI/CD runners, multi-user workstations, and containerized deployments where the fallback file storage is used (keyring unavailable).\n\n## Recommended Fix\n\n**1. Set restrictive permissions on the directory and file:**\n\n```python\n# src/mcp_atlassian/utils/oauth.py\n\nimport os\nimport stat\n\ndef _save_tokens_to_file(self, token_data: dict | None = None) -\u003e None:\n    \"\"\"Save the tokens to a file as fallback storage.\"\"\"\n    try:\n        token_dir = Path.home() / \".mcp-atlassian\"\n        token_dir.mkdir(exist_ok=True, mode=0o700)\n\n        token_path = token_dir / f\"oauth-{self.client_id}.json\"\n\n        if token_data is None:\n            token_data = {\n                \"refresh_token\": self.refresh_token,\n                \"access_token\": self.access_token,\n                \"expires_at\": self.expires_at,\n                \"cloud_id\": self.cloud_id,\n                \"base_url\": self.base_url,\n            }\n\n        # Open with restrictive permissions (owner-only read/write)\n        fd = os.open(\n            str(token_path),\n            os.O_WRONLY | os.O_CREAT | os.O_TRUNC,\n            stat.S_IRUSR | stat.S_IWUSR,  # 0o600\n        )\n        try:\n            with os.fdopen(fd, \"w\") as f:\n                json.dump(token_data, f)\n        except Exception:\n            os.close(fd)\n            raise\n\n        logger.debug(f\"Saved OAuth tokens to file {token_path} (fallback storage)\")\n    except Exception as e:\n        logger.error(f\"Failed to save tokens to file: {e}\")\n```\n\n**2. Additionally, fix the directory permissions for existing installations:**\n\n```python\n# In __init__ or from_env, ensure existing directories are tightened\ntoken_dir = Path.home() / \".mcp-atlassian\"\nif token_dir.exists():\n    os.chmod(str(token_dir), 0o700)\n```",
  "id": "GHSA-4596-2p6p-28cv",
  "modified": "2026-09-22T20:35:19Z",
  "published": "2026-09-22T20:35:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-4596-2p6p-28cv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sooperset/mcp-atlassian"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MCP Atlassian: Insecure File Permissions on OAuth Token Storage"
}

CVE-2026-77268 (GCVE-0-2026-77268)

Vulnerability from cvelistv5 – Published: 2026-09-22 18:44 – Updated: 2026-09-23 14:37

Title

MCP Atlassian: Insecure File Permissions on OAuth Token Storage

Summary

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bits can read access and refresh tokens and reuse the associated Atlassian session. The advisory traces the vulnerable input and processing flow through ~/.mcp-atlassian, oauth-<client_id>.json, access_token, and refresh_token, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 14:10 UTC

CWE

CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/sooperset/mcp-atlassian/securi…	x_refsource_CONFIRM
https://github.com/sooperset/mcp-atlassian/pull/1448	x_refsource_MISC
https://github.com/sooperset/mcp-atlassian/commit…	x_refsource_MISC
https://github.com/sooperset/mcp-atlassian/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
sooperset	mcp-atlassian	Affected: < 0.22.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77268",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T14:10:18.373472Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T14:37:35.906Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mcp-atlassian",
          "vendor": "sooperset",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.22.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bits can read access and refresh tokens and reuse the associated Atlassian session. The advisory traces the vulnerable input and processing flow through ~/.mcp-atlassian, oauth-\u003cclient_id\u003e.json, access_token, and refresh_token, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T18:44:46.039Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-4596-2p6p-28cv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-4596-2p6p-28cv"
        },
        {
          "name": "https://github.com/sooperset/mcp-atlassian/pull/1448",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
        },
        {
          "name": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
        },
        {
          "name": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
        }
      ],
      "source": {
        "advisory": "GHSA-4596-2p6p-28cv",
        "discovery": "UNKNOWN"
      },
      "title": "MCP Atlassian: Insecure File Permissions on OAuth Token Storage"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77268",
    "datePublished": "2026-09-22T18:44:46.039Z",
    "dateReserved": "2026-08-20T19:14:21.330Z",
    "dateUpdated": "2026-09-23T14:37:35.906Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-4596-2P6P-28CV

Summary

Details

PoC

Impact

Recommended Fix

CVE-2026-77268 (GCVE-0-2026-77268)

Tags

Sightings

Nomenclature

Related by attack behaviour