CVE-2026-77255: MCP Atlassian Path Traversal Vulnerability

CVE-2026-77255 Overview

CVE-2026-77255 is a path traversal vulnerability [CWE-22] in MCP Atlassian, a Model Context Protocol (MCP) server for Atlassian Confluence and Jira. Versions prior to 0.22.0 accept caller-supplied file paths in the update_issue attachments argument and route them to the attachment upload implementation without workspace validation. An attacker can direct the MCP server to read arbitrary local files and upload them as Jira attachments. This turns the server into a confused deputy that exfiltrates sensitive host file contents. The issue was fixed in version 0.22.0.

Critical Impact
Remote callers can coerce the MCP Atlassian server to read arbitrary files from the host filesystem and exfiltrate them by attaching the contents to a Jira issue.

Affected Products

MCP Atlassian versions prior to 0.22.0
Deployments exposing the Jira update_issue MCP tool
Environments where the MCP server has read access to sensitive local files

Discovery Timeline

2026-09-22 - CVE-2026-77255 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77255

Vulnerability Analysis

MCP Atlassian exposes a Jira update_issue tool that accepts an attachments argument. The server converts the argument into local paths and passes them to upload_attachment via a file_path parameter. No workspace confinement or traversal validation is applied before the file is read. A caller can therefore reference absolute paths or traversal sequences that resolve outside the intended working directory. Because the server executes the read with its own filesystem privileges, any file it can access becomes reachable. The file contents are then uploaded to a Jira issue the caller controls, providing a reliable exfiltration channel.

Root Cause

The vulnerability stems from missing input validation on the file_path value derived from the attachments argument. Prior to the fix, the handler only normalized relative paths into absolute paths using os.path.abspath, which preserves traversal outcomes rather than rejecting them. There was no check that the resolved path remained inside a designated workspace directory.

Attack Vector

An attacker with the ability to invoke the MCP server's Jira update_issue tool supplies an attachment path pointing at a sensitive local file (for example, credentials, private keys, or configuration data). The server reads the file and uploads it as an attachment on a Jira issue accessible to the attacker, who then retrieves the file through the Atlassian UI or API.

python

            return {"success": False, "error": "No file path provided"}

        try:
-            # Convert to absolute path if relative
-            if not os.path.isabs(file_path):
-                file_path = os.path.abspath(file_path)
+            # Confine the upload source to the workspace before it is read: reject
+            # traversal/absolute paths that escape CWD (arbitrary file read /
+            # exfiltration via a caller-supplied file_path).
+            file_path = str(validate_safe_path(file_path))

            # Check if file exists
            if not os.path.exists(file_path):

Source: GitHub Commit b041733. The patch replaces unconditional absolute-path conversion with validate_safe_path, which rejects traversal and absolute paths that escape the current working directory.

Detection Methods for CVE-2026-77255

Indicators of Compromise

Jira issues containing attachments whose filenames or contents match sensitive host paths such as /etc/passwd, id_rsa, .env, or cloud credential files.
MCP Atlassian log entries showing upload_attachment calls with absolute paths or paths containing .. traversal sequences.
Unexpected outbound uploads from the MCP Atlassian process to Jira attachment endpoints at unusual times or volumes.

Detection Strategies

Inspect MCP server request traces for update_issue calls whose attachments argument references paths outside the deployment's intended workspace directory.
Correlate Jira audit logs for attachment uploads by the MCP service account with the file paths logged by the MCP server.
Alert on any MCP Atlassian process reads of sensitive filesystem locations such as SSH keys, cloud credentials, or environment files.

Monitoring Recommendations

Enable verbose logging on the MCP Atlassian server for tool invocations and record the resolved file_path values passed to upload_attachment.
Monitor the Jira attachment API for spikes in uploads from MCP service accounts and review filenames for sensitive artifacts.
Use filesystem auditing (auditd, EDR) on hosts running MCP Atlassian to flag reads of high-value files by the server process.

How to Mitigate CVE-2026-77255

Immediate Actions Required

Upgrade MCP Atlassian to version 0.22.0 or later, which introduces validate_safe_path to confine attachment sources to the workspace.
Review Jira issues for attachments uploaded by the MCP service account since deployment and quarantine any that contain host files.
Rotate any credentials, tokens, or keys that resided on the MCP host filesystem and may have been exfiltrated.

Patch Information

The fix is available in MCP Atlassian release v0.22.0 and was merged via Pull Request #1448. Additional context is provided in GitHub Security Advisory GHSA-2xj6-xx86-cwwc.

Workarounds

Run the MCP Atlassian server as a low-privilege user with filesystem access restricted to a dedicated workspace directory.
Disable or filter the Jira update_issue attachments capability at the MCP gateway until the patched version is deployed.
Isolate the MCP server in a container or sandbox that has no read access to secrets, SSH keys, or cloud credential files.

bash

# Upgrade MCP Atlassian to the patched release
pip install --upgrade "mcp-atlassian>=0.22.0"

# Verify installed version
python -c "import importlib.metadata; print(importlib.metadata.version('mcp-atlassian'))"