CVE-2026-77266: MCP Atlassian Path Traversal Vulnerability

CVE-2026-77266 Overview

CVE-2026-77266 is a path traversal vulnerability [CWE-22] in MCP Atlassian, a Model Context Protocol (MCP) server that bridges AI assistants with Atlassian products such as Jira and Confluence. Versions prior to 0.22.0 accept absolute paths and traversal sequences in the upload_attachment function without confining the resolved path to the server workspace. An authenticated MCP caller with attachment permissions can read arbitrary server-local files and exfiltrate them through Jira or Confluence attachment uploads. The issue is fixed in version 0.22.0.

Critical Impact
Authenticated MCP callers can read sensitive server-side files, including configuration, credentials, and secrets, then exfiltrate them by attaching the content to Jira issues or Confluence pages.

Affected Products

MCP Atlassian versions prior to 0.22.0
Deployments exposing upload_attachment to MCP callers via Jira integration
Deployments exposing upload_attachment to MCP callers via Confluence integration

Discovery Timeline

2026-09-22 - CVE-2026-77266 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77266

Vulnerability Analysis

MCP Atlassian exposes an upload_attachment tool that accepts a file_path argument from MCP callers. In releases prior to 0.22.0, the handler converted relative paths to absolute paths using os.path.abspath but performed no workspace confinement. The advisory traces the vulnerable flow through upload_attachment, the file_path parameter, and path traversal handling. Any caller authorized to upload attachments can therefore reference /etc/passwd, .env files, cloud credential files, or other server-local data.

Once the file is read from disk, it is uploaded as an attachment to a Jira issue or Confluence page. The attachment then becomes retrievable through normal Atlassian APIs, providing an exfiltration channel out of the server host. The impact scope is limited to confidentiality; the flaw does not permit modification of server files or availability disruption.

Root Cause

The root cause is missing input validation on caller-supplied paths. The pre-patch code path converted relative paths to absolute paths but never verified that the resolved location remained inside the server workspace. Absolute paths and traversal sequences such as ../ were passed through unchanged to the file read operation.

Attack Vector

Exploitation requires network access to the MCP server and low-privilege MCP credentials with attachment access. The attacker invokes upload_attachment with a crafted file_path pointing to a sensitive server file, then retrieves the resulting attachment from Jira or Confluence.

python

            return {"success": False, "error": "No file path provided"}

        try:
-            # Convert to absolute path if relative
-            if not os.path.isabs(file_path):
-                file_path = os.path.abspath(file_path)
+            # Confine the upload source to the workspace before it is read: reject
+            # traversal/absolute paths that escape CWD (arbitrary file read /
+            # exfiltration via a caller-supplied file_path).
+            file_path = str(validate_safe_path(file_path))

            # Check if file exists
            if not os.path.exists(file_path):

Source: GitHub Commit b041733

Detection Methods for CVE-2026-77266

Indicators of Compromise

Attachments in Jira or Confluence whose contents match server configuration files, .env files, private keys, or /etc/ files.
MCP server logs showing upload_attachment invocations with absolute paths or ../ traversal sequences in the file_path argument.
Unusual attachment uploads originating from MCP service accounts outside normal workflow patterns.

Detection Strategies

Inspect MCP Atlassian request logs for upload_attachment calls where file_path begins with /, \, a drive letter, or contains .. segments.
Correlate Jira and Confluence attachment creation events with MCP tool invocations to identify uploads sourced from unexpected filesystem locations.
Baseline the set of directories legitimately used for MCP attachment uploads and alert on deviations.

Monitoring Recommendations

Enable audit logging on the MCP Atlassian server and forward logs to a centralized analytics platform for retention and search.
Monitor Atlassian attachment APIs for downloads of newly created attachments by non-standard clients following a suspicious upload.
Track file access on the MCP host for reads of sensitive paths by the MCP server process.

How to Mitigate CVE-2026-77266

Immediate Actions Required

Upgrade MCP Atlassian to version 0.22.0 or later, which introduces validate_safe_path to confine uploads to the server workspace.
Rotate any secrets, tokens, or credentials that were stored on the MCP server host and may have been readable by the service account.
Review Jira and Confluence attachments created by MCP integrations for unexpected file contents.

Patch Information

The fix is included in MCP Atlassian v0.22.0 via Pull Request #1448 and commit b041733. Full technical details are documented in GHSA-mfv2-4wvm-9pgp.

Workarounds

Restrict the MCP Atlassian service account to the minimum filesystem permissions required, and run the process in a container or chroot that excludes sensitive host files.
Disable the upload_attachment tool for untrusted MCP callers until the upgrade is applied.
Enforce allow-listed source directories for attachment uploads through host-level controls such as AppArmor or SELinux policies.

bash

# Upgrade MCP Atlassian to the patched release
pip install --upgrade "mcp-atlassian>=0.22.0"

# Verify the installed version
python -c "import importlib.metadata; print(importlib.metadata.version('mcp-atlassian'))"