mcp-atlassian has 31 CVEs on record. Disclosure cadence is accelerating: 27 in the last 90 days against 3 in the 90 before. The busiest recent month was September 2026 with 26. The median CVSS is 7.1 (high), with 2 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-22 (13) and CWE-918 (7). Most affected products: mcp_atlassian (26), mcp-atlassian (5).
CVEs per month
Last 12 months, by publish date
1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.1
- Publish → KEV
- —
- Last 90 days
- 27 prev 3
31
Total CVEs
2
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-77254Critical· 9.1MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira)62CVE-2026-77271High· 8.8MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira)61CVE-2026-77243High· 8.8MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira)61CVE-2026-27826High· 8.2MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers60CVE-2026-77262High· 8.6MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira)59
mcp-atlassian vulnerabilities
CVEs affecting mcp-atlassian, newest first. Open any entry for full detail, references, and exploit status.
31 CVEsRSS