CVE-2026-77255 in mcp-atlassian
Summary
by MITRE • 09/22/2026
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the Jira update_issue attachments argument is converted into local paths and routed to the attachment upload implementation without workspace validation. A caller can make the MCP server read arbitrary local files and attach them to a Jira issue, using the server as a confused deputy to exfiltrate the contents. The advisory traces the vulnerable input and processing flow through jira update_issue, attachments, upload_attachment, and file_path, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in MCP Atlassian prior to version 0.22.0 represents a critical security flaw rooted in improper input validation and insufficient access control mechanisms within the Model Context Protocol server implementation for Atlassian products such as Confluence and Jira. This issue specifically affects the jira update_issue endpoint, where the attachments argument is processed without adequate sanitization or workspace boundary enforcement. The core technical failure lies in the direct conversion of user-supplied input into local file system paths which are then passed to the attachment upload implementation. Because this process lacks a validation step to ensure that the requested files reside within an allowed directory structure or workspace context, the server effectively acts as a confused deputy. This architectural weakness allows any caller with access to the MCP endpoint to instruct the server to read arbitrary local files from the underlying operating system and subsequently attach them to a Jira issue, thereby facilitating unauthorized data exfiltration.
From a technical perspective, this vulnerability is classified under CWE-20 Improper Input Validation and CWE-918 Server-Side Request Forgery (SSRF) variants where the server retrieves content on behalf of a client from local resources rather than external networks. The attack vector exploits the trust relationship between the MCP caller and the Atlassian integration service. By manipulating the file_path parameter within the attachments payload, an attacker can traverse directory boundaries or reference sensitive system files such as configuration secrets, private keys, or internal application data stored on the server hosting the MCP instance. The operational impact is severe, as it enables remote attackers to bypass standard authentication and authorization controls of the Atlassian platform itself by leveraging the elevated privileges often required for file system access within server-side applications. This leads to a complete compromise of confidentiality for any files accessible by the user account running the MCP service process.
The vulnerability aligns with MITRE ATT&CK technique T1083 File and Directory Discovery, as it allows an adversary to enumerate and read local filesystem contents through the application interface. Furthermore, it reflects aspects of T1567 Exfiltration Over Web Service, where sensitive data is exfiltrated via a legitimate service channel—in this case, the Jira attachment upload functionality—to evade network-based security controls that might otherwise block direct file transfers or outbound connections to untrusted destinations. The advisory details the specific code path involving jira update_issue leading to attachments and subsequently to upload_attachment and file_path processing, highlighting where input validation checks were missing or ineffective in restricting access to authorized workspace directories only.
Mitigation for this vulnerability requires immediate upgrading of the MCP Atlassian server to version 0.22.0 or later, which implements proper path canonicalization and strict workspace boundary validation before any file operations are executed. In environments where an upgrade is not immediately feasible, administrators should restrict network access to the MCP endpoint to only trusted internal services with minimal privileges. Additionally, running the MCP service under a restricted user account with limited filesystem permissions can reduce the scope of files that could be exfiltrated even if this specific vulnerability were exploited. Regular security audits and static code analysis focused on file path handling in API endpoints are recommended to prevent similar confused deputy attacks in future development cycles.