CVE-2026-77259: MCP Atlassian Path Traversal Vulnerability

CVE-2026-77259 Overview

CVE-2026-77259 is a path traversal vulnerability [CWE-22] in MCP Atlassian, a Model Context Protocol (MCP) server that bridges AI clients with Atlassian Confluence and Jira. Versions prior to 0.22.0 expose the confluence_upload_attachment tool, which opens a caller-supplied file path without confirming the resolved path stays inside the workspace. An authenticated MCP caller can point the tool at arbitrary host files such as .env files, SSH keys, or cloud credentials. The server reads those files and uploads them as attachments to a Confluence page, where the attacker can retrieve them through the standard Atlassian interface. The issue is fixed in version 0.22.0.

Critical Impact
A low-privileged MCP caller can exfiltrate any file readable by the MCP Atlassian process, converting a Confluence integration into an arbitrary file read primitive.

Affected Products

MCP Atlassian (sooperset/mcp-atlassian) versions prior to 0.22.0
Deployments exposing the confluence_upload_attachment MCP tool
Any AI client environment integrating MCP Atlassian with Confluence Cloud or Data Center

Discovery Timeline

2026-09-22 - CVE-2026-77259 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77259

Vulnerability Analysis

MCP Atlassian implements a Confluence attachment tool that accepts a file_path argument from the MCP caller. Before the fix, the handler normalized relative paths with os.path.abspath but performed no containment check against the workspace directory. The code then executed open(file_path, "rb") and streamed the bytes to Confluence via the attachment API.

Because the path was trusted, absolute paths and traversal sequences such as ../../etc/passwd resolved directly to their targets on the host. The attachment was then persisted on a Confluence page controlled by the caller, providing a reliable exfiltration channel through Atlassian's own UI.

Root Cause

The root cause is missing path containment in src/mcp_atlassian/confluence/attachments.py. The handler converted the input to an absolute path but never validated that the resolved path remained inside the intended workspace root, violating the least-privilege boundary between the MCP tool surface and the host filesystem.

Attack Vector

Exploitation requires MCP-level access to invoke confluence_upload_attachment and a Confluence page the attacker can read. The attacker supplies a file_path pointing at sensitive host data (for example, /home/app/.env, /root/.aws/credentials, or CI secrets). The server reads the file server-side and uploads it, after which the attacker downloads the attachment from Confluence.

python

            return {"success": False, "error": "No file path provided"}

        try:
-            # Convert to absolute path if relative
-            if not os.path.isabs(file_path):
-                file_path = os.path.abspath(file_path)
+            # Confine the upload source to the workspace before it is read: reject
+            # traversal/absolute paths that escape CWD (arbitrary file read /
+            # exfiltration via a caller-supplied file_path).
+            file_path = str(validate_safe_path(file_path))

            # Check if file exists
            if not os.path.exists(file_path):

Source: GitHub commit b041733. The patch replaces the unchecked absolute-path conversion with a validate_safe_path call that rejects traversal and out-of-workspace paths before the file is opened.

Detection Methods for CVE-2026-77259

Indicators of Compromise

Confluence attachments with unusual filenames such as .env, id_rsa, credentials, shadow, or config.yaml uploaded through MCP-driven automation.
MCP Atlassian server logs showing confluence_upload_attachment calls with absolute paths or traversal sequences (.., /etc/, /root/, %HOME%).
Confluence audit logs recording attachment uploads from the MCP service account outside expected content namespaces.

Detection Strategies

Inspect MCP Atlassian request logs for file_path values that resolve outside the intended workspace directory.
Correlate confluence_upload_attachment invocations with subsequent attachment downloads from the same user or IP within a short window.
Flag Confluence attachment creation events where the filename or MIME type does not match expected business content produced by AI workflows.

Monitoring Recommendations

Forward MCP Atlassian application logs and Confluence audit events into a central analytics platform for path and filename analysis.
Alert on any attachment upload initiated by the MCP service account referencing dotfiles, key material, or files under system directories.
Baseline normal confluence_upload_attachment behavior per environment and alert on deviations in file paths, sizes, or upload volume.

How to Mitigate CVE-2026-77259

Immediate Actions Required

Upgrade MCP Atlassian to version 0.22.0 or later, which introduces validate_safe_path on the attachment handler.
Rotate any credentials, tokens, or keys that were readable by the MCP Atlassian process while a vulnerable version was deployed.
Audit Confluence attachments created by the MCP service account since deployment and remove any that contain host secrets.

Patch Information

The fix is available in MCP Atlassian release v0.22.0 and tracked in GitHub Security Advisory GHSA-6cr4-ccf3-x7h4. The change is implemented in Pull Request #1448 and commit b041733, which confines attachment sources to the workspace before the file is opened.

Workarounds

Run the MCP Atlassian server as an unprivileged user inside a container with a read-only filesystem and only the workspace directory mounted read-write.
Restrict outbound access from the MCP host and constrain which Confluence spaces the service account can write to, limiting attachment destinations.
Disable or gate the confluence_upload_attachment tool at the MCP client policy layer until the upgrade to 0.22.0 is deployed.

bash

# Upgrade MCP Atlassian to the patched release
pip install --upgrade "mcp-atlassian>=0.22.0"

# Verify the installed version
python -c "import importlib.metadata; print(importlib.metadata.version('mcp-atlassian'))"