VULNpocalypse
CriticalVulnerabilityPatch available

MCP flaws in 2026: mcp-atlassian SSRF and file write to RCE, MCP Python SDK OAuth credential theft, and OpenCode code execution at sign-in

MCP servers and clients had 2026 flaws giving RCE or OAuth credential theft. Update mcp-atlassian to 0.17.0, mcp to 1.30.0 or 2.2.0, and OpenCode to 1.18.33.

Published
Updated
Fixed in
mcp-atlassian 0.17.0; mcp (Python SDK) 1.30.0 and 2.2.0; OpenCode 1.18.33
Exploitation
A working proof of concept for the mcp-atlassian chain was posted on a criminal forum on 16 March 2026 (KELA, via Pluto Security); no exploitation reported for the others

Live scores

CVE-2026-27825
EPSS
0.115
likely to be attacked soon
VEDAS
0.730
some exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-27826
EPSS
0.130
likely to be attacked soon
VEDAS
0.982
strong exploit evidence
On CISA KEV
Not listed
Detection rule
Nuclei · Suricata

What happened

The Model Context Protocol (MCP) connects AI agents to tools and data. Three 2026 flaws show the two directions of risk: an MCP server exposed to attackers, and an MCP client talking to a malicious server.

ComponentFlawAffectedFixedRating
mcp-atlassian, CVE-2026-27826SSRF through X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers, no authentication neededbefore 0.17.00.17.0CVSS 3.1 8.2
mcp-atlassian, CVE-2026-27825confluence_download_attachment writes to any download_pathbefore 0.17.00.17.0CVSS 3.1 9.1
MCP Python SDK (mcp), CVE-2026-115563OAuth client sends credentials to an authorization server the MCP server picks1.9.1 to before 1.30.0; 2.0.0a1 to before 2.2.01.30.0, 2.2.0CVSS 3.1 7.5 (6.5 interactive)
OpenCode (no CVE)Malicious MCP server’s OAuth URL runs commands through PowerShell on Windows and WSL1.0.137 to 1.18.321.18.33Pillar proposed 9.8

mcp-atlassian (“MCPwnfluence”). mcp-atlassian is an open-source MCP server for Jira and Confluence. Before 0.17.0, anyone who could reach its HTTP endpoint could send two custom headers and no Authorization header, and the server would make requests to any URL. In cloud deployments that could expose instance metadata credentials (CVE-2026-27826). Separately, the confluence_download_attachment tool wrote to any path given in download_path. An attacker who controls the attachment content can write a cron entry and get code execution (CVE-2026-27825). Chained, the two give remote code execution. Version 0.17.0 shipped on 24 February 2026, Pluto Security published on 26 February, and the CVEs appeared on 10 March. KELA reported a working proof of concept on the XSS.PRO forum on 16 March, 20 days after the patch (Pluto Security).

MCP Python SDK OAuth (CVE-2026-115563). The official Python SDK’s OAuth client did not always check which authorization server a remote MCP server sent it to. A malicious or compromised MCP server could collect the client secret, authorization code, PKCE verifier or signed client assertion, then use them at the real service. The affected classes are OAuthClientProvider, ClientCredentialsOAuthProvider, PrivateKeyJWTOAuthProvider and the deprecated RFC7523OAuthClientProvider in mcp.client.auth. MCP servers built with the SDK, stdio clients and clients that attach their own tokens are not affected (GitHub advisory). The issuer checks shipped on 7 September in 1.30.0 and 2.2.0, listed as behavior changes. The advisory followed on 28 September, after a report by Cycode and others (The Hacker News).

OpenCode. During MCP OAuth sign-in, OpenCode passed the server-supplied authorization URL to a helper that built a PowerShell command on Windows and WSL without escaping it. A crafted URL ran commands as the developer. It only fires when the developer runs opencode mcp auth or the matching request; macOS and Linux are not affected. Pillar Security reported it on 29 August. OpenCode fixed it in 1.18.33 on 28 September in a pull request described as a browser-launch refactor, with no CVE or advisory, so scanners will not flag old builds. The vendor, Anomaly, said a malicious MCP server is outside its threat model (The Hacker News).

Am I affected?

bash
# mcp-atlassian server (fixed in 0.17.0)
pip show mcp-atlassian 2>/dev/null | grep -i '^version'
docker ps --format '{{.Image}}' | grep -i mcp-atlassian

# MCP Python SDK in your client projects (fixed in 1.30.0 / 2.2.0)
pip show mcp 2>/dev/null | grep -i '^version'
grep -rnE 'OAuthClientProvider|ClientCredentialsOAuthProvider|PrivateKeyJWTOAuthProvider|RFC7523OAuthClientProvider' --include='*.py' .

# OpenCode (fixed in 1.18.33) and the remote MCP servers it trusts
opencode --version
opencode mcp list
  • mcp-atlassian is most exposed when run with an HTTP transport that other machines can reach. CVE-2026-27826 needs no credentials (CVE-2026-27826). Also check MCP client configs (for example claude_desktop_config.json, .cursor/mcp.json, .vscode/mcp.json) for which servers you run.
  • Python SDK users are affected only if a client uses one of the OAuth providers above to reach a remote MCP server you do not fully control (GitHub advisory).
  • OpenCode users are affected on Windows or WSL, with a remote MCP server configured, if they ever ran opencode mcp auth against a server they did not control (The Hacker News).

What to do now

  1. Update mcp-atlassian to 0.17.0 or later. Bind its HTTP transport to localhost or put it behind authentication. If an older version was reachable from a network, check the host for new cron entries and files written by the server’s user, and rotate the Atlassian tokens and cloud credentials it held (Pluto Security).
  2. Update mcp to 1.30.0 (1.x) or 2.2.0 (2.x) or later in every client project (GitHub advisory).
  3. Pass issuer= to ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider. Without it, the update does not protect these two providers. Move off RFC7523OAuthClientProvider, which has no issuer option (GitHub advisory).
  4. Clear stored OAuth client registrations once after updating the SDK, so they re-register bound to an issuer. If a client may have reached an untrusted MCP server, rotate its client secret and revoke its tokens at the authorization server (GitHub advisory).
  5. Update OpenCode to 1.18.33 or later. If you cannot, remove remote MCP servers you have not vetted and do not run opencode mcp auth against them (The Hacker News).

Why this matters

Two of these three fixes shipped quietly. The Python SDK fix was described as a behavior change three weeks before its advisory, and the OpenCode fix as a refactor with no advisory at all. Teams that update MCP clients only when a scanner flags a CVE would have missed both. Track releases of the MCP components you run, not just CVE feeds.

Sources