medium · CVSS v3 4.3 · CVSS v4 5.3

CVE-2026-124503

A vulnerability was identified in sooperset mcp-atlassian up to 0.24.0. This issue affects the function validate_safe_pa…

Description

A vulnerability was identified in sooperset mcp-atlassian up to 0.24.0. This issue affects the function validate_safe_path of the file src/mcp_atlassian/utils/io.py. The manipulation of the argument path leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 0.24.1 is capable of addressing this issue. Upgrading the affected component is recommended. This CVE was requested by the vendor.

Scores

Severity
medium
CVSS v2
4
CVSS v3
4.3
CVSS v4
5.3
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-89115

SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection. An attacker with high privileges and local access could inspect the memory to recover credentials and reuse them for authentication. This results in a high impact on confidentiality and no impact on integrity and availability.

View analysis

medium

CVE-2026-89128

Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affected service, resulting in a low impact on confidentiality. Integrity and availability remain unaffected.

View analysis

medium

CVE-2026-89129

SAP NetWeaver AS Java Web Services is vulnerable to an unauthenticated Server‑Side Request Forgery (SSRF) that allows an attacker to trigger a SOAP fault to a URL under their control. This flaw can leak information about internal systems, compromising confidentiality. The vulnerability does not affect integrity or availability.

View analysis

medium

CVE-2026-89131

SAP NetWeaver Enterprise Portal does not sufficiently protect certain server-side actions against cross-site request forgery. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, triggers an unintended action on the server. Successful exploitation could allow the attacker to modify non-sensitive information, resulting in a low impact on integrity. There is no impact on confidentiality and availability.

View analysis