Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

sooperset/mcp-atlassian

              main @ ba72540
            

Fixes

CVEs

HIGH

Peak severity

15.4%

Coverage

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

src/mcp_atlassian/servers/main.py: most-fixed (3 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: Insecure handling of user-supplied endpoints allowed unauthenticated attackers to trigger arbitrary outbound requests. Mitigation requires strict hostname validation and private IP filtering in connection middleware.

Path Traversal: Attachment download endpoints across Confluence and Jira did not restrict file resolution to the target directory. This allowed directory traversal unless resolved paths were explicitly restricted to an allowed prefix.

Auth Bypass: System level configurations (like .netrc) could override explicitly defined OAuth tokens or PAT configurations inside HTTP client sessions, causing authentication bypasses.