CVE-2026-77257 in Mcp Atlassian
Summary
by MITRE • 09/22/2026
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, HTTP-exposed Jira and Confluence upload tools pass a caller-provided file_path to local file operations without restricting it to the workspace. A remote MCP caller with tool access can cause the server to read sensitive local files and upload them as Atlassian attachments. The advisory traces the vulnerable input and processing flow through streamable-http, upload_attachment, and file_path, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in MCP Atlassian versions prior to 0.22.0 represents a critical path traversal flaw within the Model Context Protocol server implementation for Atlassian products such as Confluence and Jira. This security defect arises from an insufficient validation of user-supplied input during file upload operations, specifically affecting the HTTP-exposed tools designed for managing attachments in these platforms. The core technical failure lies in the handling of the caller-provided file_path parameter within the streamable-http interface. When a remote MCP client with appropriate tool access invokes the upload_attachment function, it can supply arbitrary file paths that are not sanitized or restricted to the designated workspace directory. This lack of path normalization allows an attacker to traverse up the local filesystem hierarchy using standard relative path sequences such as dot-dot-slash characters.
From a technical perspective, this flaw constitutes a classic Local File Inclusion and Path Traversal vulnerability. The server processes the provided file_path directly for local file operations without verifying that the resolved absolute path remains within the expected application context or workspace boundaries. Consequently, an authenticated remote attacker can manipulate this input to read sensitive files from the underlying operating system where the MCP Atlassian server is hosted. These could include configuration files containing database credentials, private keys, environment variables with secrets, or other proprietary data stored on the host machine. The operational impact extends beyond mere information disclosure because the vulnerability enables the exfiltration of these sensitive local files by uploading them as attachments within Confluence or Jira pages. This effectively turns a standard collaboration feature into an unauthorized data export mechanism accessible to any user granted access to the upload tools via the MCP interface.
This incident aligns with Common Weakness Enumeration category CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The exploitation technique maps directly to MITRE ATT&CK tactic T1083, File and Directory Discovery, specifically the sub-technique for accessing local system information through file enumeration. Furthermore, because the attack relies on authenticated access to specific tools within the MCP server, it also reflects aspects of privilege escalation where a lower-privileged user leverages application functionality to access resources outside their intended scope. The advisory explicitly traces this vulnerable input and processing flow through the streamable-http transport layer into the upload_attachment tool logic, highlighting that the control failure occurs at the point where external input is passed directly to local file system APIs without boundary checks.
To mitigate this vulnerability, organizations must immediately upgrade MCP Atlassian to version 0.22.0 or later, which implements proper path validation and restriction mechanisms. In addition to upgrading, administrators should enforce strict least-privilege principles for users interacting with the MCP server, ensuring that only necessary personnel have access to file upload tools. Network-level controls such as firewalls can be configured to restrict inbound connections to the MCP Atlassian service to trusted IP ranges only, reducing the attack surface available to remote attackers. It is also advisable to implement input validation at the application layer for any custom integrations or scripts that interact with these APIs, ensuring that file paths are canonicalized and verified against a whitelist of allowed directories before being processed by the server. Regular security audits of third-party plugins and extensions should be conducted to identify similar path handling weaknesses in other components of the Atlassian ecosystem.