Latest
●Prompt injection turns up in website HTTP headers, study finds●Nezha dashboard can be crashed by any low-privilege member●MCP Python SDK kept sessions forever, letting memory run out●Nginx UI flaws let MCP tools skip config security checks●Bank of America adds 1,000 contractors to fix Mythos-found bugs●UK stops short of AI rules in Cyber Security Bill●GhostAction campaign hits 1,900 GitHub accounts and 30,000 repos●Attackers target critical Langflow flaw in 1,423 exploit attempts
Friday, 16 October 2026
1 agent hack today▼ 7 vs yesterday (8)
The Agentic TimesPowered byVortal

Incident database

MCP Atlassian: Multiple Critical Vulnerabilities in File Handling and OAuth

Six critical vulnerabilities discovered in the Model Context Protocol Atlassian package affecting file access, SSRF protection, credential storage, XSS, and path traversal validation. These include arbitrary file read via upload functions, missing SSRF redirect checks in OAuth/basic auth branches, world-readable OAuth token storage, reflected XSS in callback handler, and incomplete path traversal protection allowing module overwrite and RCE.

Disclosed 22 September 2026 · Record updated 1 October 2026

Impact

Multiple critical vulnerabilities allowing unauthorized file access, credential theft, server-side request forgery, cross-site scripting, and remote code execution. The arbitrary file read vulnerability can exfiltrate API tokens from /proc/self/environ on Linux systems, and the incomplete path traversal fix allows attackers to overwrite Python modules for RCE.

Our coverage

Sources

  1. github.comhttps://github.com/advisories/GHSA-f26r-j276-ggg4
  2. github.comhttps://github.com/advisories/GHSA-6529-c226-h328
  3. github.comhttps://github.com/advisories/GHSA-6cr4-ccf3-x7h4
  4. github.comhttps://github.com/advisories/GHSA-4596-2p6p-28cv
  5. github.comhttps://github.com/advisories/GHSA-g2r2-3j32-j27x
  6. github.comhttps://github.com/advisories/GHSA-6vmq-24h2-pj7j