CVE-2026-77247: MCP Atlassian Path Traversal Vulnerability

CVE-2026-77247 Overview

CVE-2026-77247 is a path traversal vulnerability [CWE-73] in MCP Atlassian, a Model Context Protocol (MCP) server that connects AI clients to Atlassian Jira and Confluence. Versions prior to 0.22.0 allow a caller-controlled file_path argument to be interpreted directly by the MCP server. The upload tools open the referenced file and send its contents as an attachment. In remote or multi-user deployments, an authenticated client can read arbitrary host files that the server process can access, without needing shell or filesystem access. The issue is fixed in version 0.22.0.

Critical Impact
A permitted MCP client can exfiltrate arbitrary files from the MCP Atlassian host by supplying absolute or traversal paths to Jira and Confluence attachment upload tools.

Affected Products

MCP Atlassian versions prior to 0.22.0
Confluence upload tools using AttachmentsMixin.upload_attachment and AttachmentsMixin.upload_attachments
Jira update_issue tool accepting file_path and file_paths arguments

Discovery Timeline

2026-09-22 - CVE-2026-77247 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77247

Vulnerability Analysis

MCP Atlassian exposes tools that accept file paths from MCP clients and upload the referenced files as attachments to Jira issues or Confluence pages. The vulnerable code path treats the client-supplied file_path (or file_paths) as trusted and calls os.path.abspath on relative inputs before opening the file. Absolute paths and traversal sequences such as ../ are not rejected. A permitted client can therefore request upload of any file the server process can read, including SSH keys, configuration files containing credentials, and internal application data. The uploaded attachment becomes accessible via the target Jira or Confluence instance, providing a straightforward exfiltration channel in remote and multi-tenant deployments.

Root Cause

The root cause is external control of a file name or path [CWE-73]. The affected entry points, AttachmentsMixin.upload_attachment, AttachmentsMixin.upload_attachments, and Jira update_issue, did not confine upload sources to a workspace boundary. Any authenticated MCP caller could specify arbitrary absolute or traversal paths that the server would open on their behalf.

Attack Vector

Exploitation requires network access to the MCP Atlassian server and low-privilege authenticated access as a permitted MCP client. No user interaction is required. The attacker invokes an attachment upload tool with a crafted file_path such as /etc/passwd or ../../root/.ssh/id_rsa, and then retrieves the resulting attachment through the Jira or Confluence UI or API.

python

            return {"success": False, "error": "No file path provided"}

        try:
-            # Convert to absolute path if relative
-            if not os.path.isabs(file_path):
-                file_path = os.path.abspath(file_path)
+            # Confine the upload source to the workspace before it is read: reject
+            # traversal/absolute paths that escape CWD (arbitrary file read /
+            # exfiltration via a caller-supplied file_path).
+            file_path = str(validate_safe_path(file_path))

            # Check if file exists
            if not os.path.exists(file_path):

Source: GitHub Commit b041733. The patch replaces unrestricted path normalization with validate_safe_path, which rejects inputs that escape the current working directory.

Detection Methods for CVE-2026-77247

Indicators of Compromise

Jira or Confluence attachments with filenames matching sensitive host paths such as passwd, shadow, id_rsa, .env, or config.yaml.
MCP Atlassian server logs recording upload_attachment or update_issue calls with absolute paths or .. traversal sequences in the file_path argument.
Unexpected attachments created by service accounts or automation identities used by MCP clients.

Detection Strategies

Inspect MCP Atlassian request logs for file_path and file_paths values that begin with /, \, or contain .. separators.
Correlate attachment creation events in Jira and Confluence audit logs with the identity and source IP of the MCP client that initiated them.
Alert on attachments whose original filenames match common credential, key, or configuration file patterns.

Monitoring Recommendations

Enable verbose logging of MCP tool invocations, including arguments, on the MCP Atlassian server.
Forward Jira and Confluence attachment audit events to a centralized logging or SIEM platform for correlation with MCP server activity.
Review the current working directory of the MCP Atlassian process and monitor for reads of files outside that boundary.

How to Mitigate CVE-2026-77247

Immediate Actions Required

Upgrade MCP Atlassian to version 0.22.0 or later, which introduces validate_safe_path on all attachment upload entry points.
Audit recent Jira and Confluence attachments for files sourced from outside expected upload directories and remove any exfiltrated content.
Rotate credentials, API tokens, and SSH keys that were readable by the MCP Atlassian process account.

Patch Information

The fix is released in MCP Atlassian v0.22.0 via Pull Request #1448 and commit b041733. Full technical details are documented in GHSA-f6pj-qv47-g96w.

Workarounds

Run the MCP Atlassian server under a dedicated, least-privileged user account with access only to a scoped working directory containing legitimate upload sources.
Restrict network access to the MCP Atlassian server so only trusted clients can invoke upload tools until the patch is applied.
Disable or block the Jira and Confluence attachment upload tools at the MCP proxy or gateway layer if patching cannot occur immediately.

bash

# Upgrade MCP Atlassian to the patched release
pip install --upgrade "mcp-atlassian>=0.22.0"

# Verify installed version
pip show mcp-atlassian | grep -i version