github Python analyzed 31c1d77

sooperset/mcp-atlassian

MCP server for Atlassian tools (Confluence, Jira)

maintainer: sooperset
license: MIT
first seen: 2026-05-22
last seen: 2026-08-01
releases · 30d: 3
short id

risk 99/100 · heuristic grade

E critical

vulnerabilities attested + 50
capability exposure inferred + 28
recent drift inferred + 12
tool safety inferred + 17
trust mitigators mixed − 8

attested inferred mixed

The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.

graded 8m ago · see ecosystem CVEs →

risk trajectory 5 movements

2d ago D · 70 → E · 99
3w ago D · 73 → D · 70
3w ago B · 23 → D · 73
3w ago B · 20 → B · 23
6w ago A · 0 → B · 20

capability exposure grade factor +28

Inferred surface — each links to servers holding it:

vulnerabilities 20 CVEs · grade factor +50

CRITICAL

Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials affects ["< 0.22.0"]

CRITICAL

[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any no … affects ["< 0.22.0"]

CRITICAL

Arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluen … EPSS 2% CVE-2026-27825 affects ["<0.17.0"]

HIGH

SSRF Protection Bypass affects ["< 0.22.0"]

HIGH

Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rg … affects ["< 0.22.0"]

HIGH

Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHS … affects ["< 0.22.0"]

HIGH

SSRF redirect protection missing for basic-auth and OAuth authentication branches affects ["< 0.22.0"]

HIGH

Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira) — mir … affects ["< 0.22.0"]

HIGH

Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path() affects ["< 0.22.0"]

HIGH

Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials affects ["< 0.22.0"]

HIGH

HTTP upload tools accept arbitrary server-local file paths affects ["< 0.22.0"]

HIGH

Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue affects ["< 0.22.0"]

HIGH

Jira and Confluence attachment upload tools can read arbitrary server-local files affects ["< 0.22.0"]

HIGH

Multiple vulnerabilities: SSRF via icon_url + attachment URL, JQL injection, Stored XSS affects ["< 0.22.0"]

HIGH

MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path affects ["< 0.22.0"]

HIGH

Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path paramet … affects ["< 0.22.0"]

HIGH

Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth … affects ["< 0.22.0"]

HIGH

ENABLED_TOOLS / Toolset authorization bypass in mcp-atlassian affects ["< 0.22.0"]

HIGH

Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned) affects ["< 0.22.0"]

HIGH

DNS-rebinding TOCTOU bypass of the SSRF fix (GHSA-7r34): unauthenticated SSRF to cloud metadata on p … affects ["< 0.22.0"]

tool safety 2 findings · grade factor +17

high dangerous code

dynamic exec: pickle.loads(), __import__ sink
medium toxic flow (lethal trifecta)

lethal trifecta reachable across this server's tool + source surface: private-data access + untrusted-content ingestion + network exfil (a leg is proven only in the analyzed source)

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 31c1d77 · analyzer v28 · 2d ago

skills & prompt files 3

agent-rules sooperset-mcp-atlassian-31c1d77/.github/copilot-instructions.md
agent-rules sooperset-mcp-atlassian-31c1d77/AGENTS.md
agent-rules sooperset-mcp-atlassian-31c1d77/CLAUDE.md

danger signals7

dynamic code execution pickle.loads() sooperset-mcp-atlassian-31c1d77/tests/unit/test_exceptions.py :150 unpickled_error = pickle.loads(pickled_data)
dynamic code execution __import__ sink sooperset-mcp-atlassian-31c1d77/tests/unit/test_truststore_env.py :171 for k, v in __import__("os").environ.items()
suspicious endpoint 169.254.169.254 (cloud metadata) sooperset-mcp-atlassian-31c1d77/tests/unit/jira/test_client.py :99 internal_redirect.headers = {"Location": "http://169.254.169.254/latest/meta-data/"}
suspicious endpoint 169.254.169.254 (cloud metadata) sooperset-mcp-atlassian-31c1d77/tests/unit/servers/test_dependencies.py :2447 result = validate_url_for_ssrf("http://169.254.169.254")
suspicious endpoint 169.254.169.254 (cloud metadata) sooperset-mcp-atlassian-31c1d77/tests/unit/servers/test_main_server.py :730 (b"x-atlassian-jira-url", b"http://169.254.169.254/latest/meta-data/"),
suspicious endpoint 169.254.169.254 (cloud metadata) sooperset-mcp-atlassian-31c1d77/tests/unit/test_external_auth.py :489 headers={"X-Atlassian-Jira-Url": "http://169.254.169.254/latest/meta-data"}
suspicious endpoint 169.254.169.254 (cloud metadata) sooperset-mcp-atlassian-31c1d77/tests/unit/utils/test_urls.py :247 result = validate_url_for_ssrf("http://169.254.169.254")

other grade factors evidence elsewhere

recent drift +12 capability drift →

embed badge readme-ready

[![MCP Observatory risk grade](https://mcpobservatory.com/servers/mcpso:sooperset/mcp-atlassian/badge.svg)](https://mcpobservatory.com/servers/mcpso:sooperset/mcp-atlassian/security)

Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of sooperset.

sooperset/mcp-atlassian

skills & prompt files 3

danger signals7

Navigate

Stream

Features

Display