CVE-2026-77256 sooperset CVE debrief

Who should care

Defenders responsible for Atlassian product security, local system administrators, and teams managing user access and permissions should assess exposure and prioritize remediation.

Why it matters

CVE-2026-77256 allows local users to read plaintext OAuth tokens due to permissive file permissions in MCP Atlassian. Defenders should prioritize verification, upgrading to version 0.22.0, and implementing compensating controls.

• Local users may read plaintext OAuth tokens
• Refresh tokens may be used to retain unauthorized access
• Defenders must verify and upgrade to version 0.22.0
• Compensating controls may be necessary to mitigate exposure

Technical summary

MCP Atlassian, a Model Context Protocol (MCP) server for Atlassian products, writes a plaintext OAuth fallback file with permissions inherited from the process umask. Prior to version 0.22.0, this allows other local users to read the backup and retain Atlassian access through the refresh token. The vulnerability affects local users who can read the backup and retain Atlassian access through the refresh token. Defenders should prioritize verifying and upgrading to version 0.22.0, assessing local user access and permissions, and implementing compensating controls to mitigate potential exposure.

Defensive priority

Defenders should prioritize verifying and upgrading to version 0.22.0, assessing local user access and permissions, and implementing compensating controls to mitigate potential exposure.

Recommended defensive actions

• Verify and upgrade to version 0.22.0
• Assess local user access and permissions
• Implement compensating controls to mitigate potential exposure
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The advisory provides details on the vulnerable input and processing flow through OAuthConfig._save_tokens_to_file, refresh_token, access_token, and umask. The issue is fixed in version 0.22.0. The vulnerability allows local users to read the plaintext OAuth fallback file containing refresh and access tokens due to inherited permissions from the process umask. Defenders should verify and upgrade to version 0.22.0, assess local user access and permissions, and implement compensating controls to mitigate potential exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.