MCP Atlassian writes plaintext fallback files that contain both access and refresh tokens, storing them with group‑readable permissions. An attacker who can read files in the user’s .mcp‑atlassian directory can reuse these credentials to authenticate to Atlassian Confluence and Jira services, effectively compromising the victim’s account. This flaw is a classic example of insecure storage of sensitive data (CWE‑312) and enables privilege escalation within the local environment.

All installations of the MCP Atlassian server older than version 0.22.0 deployed on Atlassian Confluence and Jira systems. The vulnerable code resides in the sooperset/mcp‑atlassian repository and affects any user or process that can read the plaintext token files located under the caller’s ~/.mcp‑atlassian directory.

The CVSS score of 6.1 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited widespread exploitation so far. Likely exploitation requires local access or a user with the same group; when a permissive umask allows group or other users to read the token files, the attacker can obtain valid OAuth tokens. As the issue is limited to local file discovery and token reuse it does not provide remote code execution but does provide unauthorized access to Atlassian resources.