CVE-2026-77272 sooperset CVE debrief

Who should care

Defenders responsible for MCP Atlassian servers, particularly those using versions prior to 0.22.0, should assess exposure and apply the patch to prevent potential script injection attacks.

Why it matters

CVE-2026-77272 allows for script injection in MCP Atlassian servers prior to version 0.22.0, impacting users completing the OAuth flow. Defenders should verify exposure, apply the patch, and monitor for suspicious activity.

• Potential script injection in user browsers completing the OAuth flow
• Possible unauthorized actions or data exposure due to injected scripts
• Required verification of MCP Atlassian version and application of patch
• Need for monitoring and incident response planning

Technical summary

The MCP Atlassian server for Atlassian products has a vulnerability where the OAuth error query parameter is passed to CallbackHandler._send_response in oauth_setup.py and interpolated into an HTML page without escaping. This allows for crafted authorization callbacks to inject markup or script that executes in the browser of a user completing the OAuth flow. The vulnerability impacts users completing the OAuth flow, and defenders should assess exposure and apply the patch to prevent potential script injection attacks.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch to prevent potential script injection attacks.

Recommended defensive actions

• Verify if MCP Atlassian version is prior to 0.22.0 and apply the patch if necessary
• Review OAuth flow completion for potential script injection
• Monitor for suspicious activity related to MCP Atlassian
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. However, additional information on potential exploitation or affected systems is limited. Defenders should verify if MCP Atlassian version is prior to 0.22.0 and apply the patch if necessary. Review OAuth flow completion for potential script injection and monitor for suspicious activity related to MCP Atlassian. The vulnerability allows for script injection in MCP Atlassian servers prior to version 0.22.0, impacting users completing

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.