CVE-2026-77257: MCP Atlassian Path Traversal Vulnerability

CVE-2026-77257 Overview

CVE-2026-77257 is a path traversal vulnerability [CWE-22] in MCP Atlassian, a Model Context Protocol (MCP) server that bridges AI assistants with Atlassian Confluence and Jira. In versions prior to 0.22.0, the HTTP-exposed Jira and Confluence upload_attachment tools accept a caller-provided file_path parameter without restricting it to the workspace directory. A remote MCP caller with tool access can direct the server to read arbitrary local files and upload them as Atlassian attachments. The advisory identifies the vulnerable flow through streamable-http, upload_attachment, and file_path handling. The issue is fixed in version 0.22.0.

Critical Impact
Authenticated remote MCP callers can exfiltrate sensitive files from the server host, including credentials, tokens, and configuration data, by uploading them as attachments to attacker-controlled Atlassian resources.

Affected Products

MCP Atlassian server versions prior to 0.22.0
Deployments exposing the MCP server over HTTP (streamable-http transport)
Confluence and Jira upload_attachment tool endpoints

Discovery Timeline

2026-09-22 - CVE-2026-77257 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77257

Vulnerability Analysis

MCP Atlassian implements upload tools that accept a file_path string from remote callers and read the referenced file before uploading its contents as an Atlassian attachment. Before the fix, the server converted relative paths to absolute paths using os.path.abspath() without validating that the resolved path remained inside the intended workspace directory. This allowed any caller with tool access to reference arbitrary absolute paths or use .. traversal sequences to escape the workspace.

Because the resulting file contents are uploaded to Confluence or Jira, the vulnerability creates a reliable exfiltration channel. Attackers can read files such as /etc/passwd, SSH private keys, cloud credentials, .env files, and application configuration containing API tokens, then retrieve them from the Atlassian instance. The HTTP transport widens exposure because deployments intended for LAN or trusted-agent use may be reachable by lower-privileged callers.

Root Cause

The root cause is missing path canonicalization and containment checks on user-controlled input passed to local file operations. The upload_attachment code path trusted file_path after only normalizing it to an absolute path, violating the principle that external input must be constrained to an allowlisted directory before file I/O.

Attack Vector

An authenticated MCP caller invokes an upload tool over the streamable-http transport and supplies file_path values pointing to sensitive files outside the workspace. The server reads each file and forwards its content to Atlassian as an attachment, which the attacker later downloads.

python

            return {"success": False, "error": "No file path provided"}

        try:
-            # Convert to absolute path if relative
-            if not os.path.isabs(file_path):
-                file_path = os.path.abspath(file_path)
+            # Confine the upload source to the workspace before it is read: reject
+            # traversal/absolute paths that escape CWD (arbitrary file read /
+            # exfiltration via a caller-supplied file_path).
+            file_path = str(validate_safe_path(file_path))

            # Check if file exists
            if not os.path.exists(file_path):

Source: GitHub Commit b041733

Detection Methods for CVE-2026-77257

Indicators of Compromise

Atlassian attachments with unexpected filenames matching sensitive system paths such as passwd, id_rsa, .env, or credentials.json
MCP server logs recording upload_attachment calls with absolute file_path values or .. traversal sequences
Attachments uploaded to Confluence pages or Jira issues owned or created by low-trust MCP callers within a short timeframe
Outbound traffic from the MCP host to Atlassian endpoints correlated with reads of files outside the configured workspace directory

Detection Strategies

Parse MCP server access logs for file_path arguments that resolve outside the intended working directory
Alert on file read operations by the MCP process targeting system directories such as /etc, /root, ~/.ssh, or ~/.aws
Monitor Atlassian audit logs for attachment uploads whose content types or sizes deviate from normal user activity
Correlate MCP tool invocations with subsequent file system access events via endpoint telemetry

Monitoring Recommendations

Enable verbose logging on the MCP Atlassian server for all tool invocations, including argument values
Ingest MCP and Atlassian audit logs into a centralized SIEM for cross-source correlation
Track process-level file access from the MCP service account and alert on reads outside the workspace root
Review attachment creation events in Confluence and Jira for filenames or content indicative of host system files

How to Mitigate CVE-2026-77257

Immediate Actions Required

Upgrade MCP Atlassian to version 0.22.0 or later, which enforces workspace containment via validate_safe_path()
Restrict network access to the MCP HTTP endpoint so that only trusted callers can reach the streamable-http transport
Rotate any credentials, tokens, or keys stored on the MCP host that may have been accessible to the service account
Audit Atlassian attachments created since the server was deployed for evidence of exfiltrated host files

Patch Information

The fix is included in MCP Atlassian release v0.22.0. The patch introduces validate_safe_path() to confine upload sources to the current working directory and rejects absolute paths or traversal sequences that escape it. See GHSA-mrq8-fv7v-hhjg and pull request #1448 for full context.

Workarounds

Disable the HTTP transport and operate the MCP server only over local stdio when possible
Run the MCP Atlassian server as an unprivileged user with a dedicated workspace that contains no sensitive files
Apply filesystem-level restrictions such as containerization or AppArmor/SELinux policies to block reads outside the workspace directory
Require strong authentication and authorization on the MCP transport and limit tool exposure to trusted principals

bash

# Upgrade to the patched version
pip install --upgrade "mcp-atlassian>=0.22.0"

# Verify installed version
pip show mcp-atlassian | grep -i version