A high-severity vulnerability in the sooperset mcp-atlassian server enables local attackers to steal OAuth credentials, potentially resulting in unauthorized access to connected Jira and Confluence instances.

The application incorrectly handles file permissions when writing plaintext OAuth fallback files, specifically within the OAuthConfig._save_tokens_to_file function. Because these files inherit permissions from the process umask, they may be readable by other local users on the host system.

Successful exploitation of this flaw allows a malicious local actor to obtain valid refresh and access tokens for Atlassian products. Given the CVSS score of 8.3, this represents a significant security risk, as it permits lateral movement and unauthorized data access within Jira or Confluence environments. Compromise of these tokens effectively grants the attacker the identity of the affected user, leading to potential data exfiltration or service disruption.

Immediate Action: Upgrade the mcp-atlassian installation to version 0.22.0 or later to ensure secure file permission handling.

Proactive Monitoring: Review system access logs and audit the file system for unauthorized read attempts on configuration directories, particularly those storing OAuth tokens.

Compensating Controls: If immediate patching is not feasible, restrict local user access to the server host and enforce strict umask settings for the service process to limit the exposure of sensitive files.

Public Exploit Available: Unknown.

The risk posed by this vulnerability necessitates immediate attention to prevent local credential harvesting. Security teams must prioritize upgrading to version 0.22.0 to remediate the insecure permission assignment. Organizations should also verify that their server hardening standards, such as umask configurations, are consistently applied to minimize the impact of similar file-based vulnerabilities.