CVE-2026-77256Proof of concept (PoC) published · CISA
MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask
CVSS score
8.3
EPSS probability
%0.3
Risk score
0.0
Published
23 d ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
9.1
CVE-2026-77254
MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials
S
Patch verifiedEPSS %1
8.3
CVE-2026-77271
MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)
S
Patch verifiedEPSS %1
8.6
CVE-2026-77262
MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825)
S
Patch verifiedEPSS %0
7.7
CVE-2026-73496
MCP Atlassian: Arbitrary server-side file read via attachment upload
S
Patch status unknownEPSS %0
7.7
CVE-2026-73498
MCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_attachment
S
Patch verifiedEPSS %0
8.6
CVE-2026-77248
MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport
S
Patch verifiedEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-77256"