CVE-2026-77269: MCP Atlassian Path Traversal Vulnerability

CVE-2026-77269 Overview

CVE-2026-77269 is a path traversal vulnerability [CWE-22] in MCP Atlassian, a Model Context Protocol (MCP) server that integrates AI assistants with Atlassian Confluence and Jira. The flaw exists in the upload_attachment handler prior to version 0.22.0. An authenticated caller can supply an absolute or traversal-based file_path argument, causing the server to read and upload any file readable by the server process. The prior fix for CVE-2026-27825 constrained download destinations but did not sanitize upload source paths. Version 0.22.0 remediates the issue by validating source paths through validate_safe_path.

Critical Impact
An authenticated attacker can exfiltrate arbitrary local files from the MCP server host by uploading them as attachments to Confluence or Jira.

Affected Products

MCP Atlassian versions prior to 0.22.0
Deployments exposing the upload_attachment MCP tool to callers
Environments where the MCP server has read access to sensitive local files

Discovery Timeline

2026-09-22 - CVE CVE-2026-77269 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77269

Vulnerability Analysis

MCP Atlassian exposes an upload_attachment tool that accepts a caller-controlled file_path string. In versions before 0.22.0, the handler in src/mcp_atlassian/confluence/attachments.py converted relative paths to absolute paths using os.path.abspath without validating that the resulting path remained inside an approved workspace directory. A caller can therefore supply values such as /etc/passwd, ../../../.env, or ~/.ssh/id_rsa and cause the server to read those files and transmit their contents as Confluence or Jira attachments.

The flaw is a bypass of the earlier remediation for CVE-2026-27825, which addressed only download-destination handling. Because attachments are written into an Atlassian project the caller already accesses, the exfiltration channel is legitimate application traffic, which limits the value of network-layer detection.

Root Cause

The root cause is missing source-path validation on attachment uploads. The handler trusted file_path inputs after normalization and did not enforce a workspace boundary. Any file readable by the MCP server process was reachable.

Attack Vector

Exploitation requires authenticated access to invoke the upload_attachment MCP tool. The attacker submits a crafted file_path referencing a sensitive local file, then retrieves the uploaded attachment through the Atlassian UI or API to complete exfiltration.

python

            return {"success": False, "error": "No file path provided"}

        try:
-            # Convert to absolute path if relative
-            if not os.path.isabs(file_path):
-                file_path = os.path.abspath(file_path)
+            # Confine the upload source to the workspace before it is read: reject
+            # traversal/absolute paths that escape CWD (arbitrary file read /
+            # exfiltration via a caller-supplied file_path).
+            file_path = str(validate_safe_path(file_path))

            # Check if file exists
            if not os.path.exists(file_path):

Source: GitHub Commit b041733. The patch replaces unchecked path normalization with validate_safe_path, rejecting traversal and absolute paths that escape the current working directory.

Detection Methods for CVE-2026-77269

Indicators of Compromise

Confluence or Jira attachments whose filenames match sensitive host artifacts such as passwd, shadow, id_rsa, .env, or config.yaml.
MCP server logs recording upload_attachment invocations with file_path values containing .., absolute paths outside the workspace, or leading ~.
Attachment upload events originating from a single MCP session at high volume or targeting unrelated Atlassian spaces.

Detection Strategies

Parse MCP server logs for upload_attachment calls and flag any file_path argument that resolves outside the configured working directory.
Compare uploaded attachment content hashes against known sensitive files on the MCP host, such as SSH keys and environment files.
Alert on Atlassian audit events showing attachments created by service accounts tied to MCP integrations with unusual filenames or MIME types.

Monitoring Recommendations

Enable verbose logging of MCP tool invocations, including full argument values, and forward them to a centralized log store.
Track the version of mcp-atlassian deployed across all hosts and alert on any instance below 0.22.0.
Baseline normal attachment upload behavior per MCP user and generate anomalies on deviations in file paths or upload frequency.

How to Mitigate CVE-2026-77269

Immediate Actions Required

Upgrade mcp-atlassian to version 0.22.0 or later on every deployment.
Restrict which identities can invoke the upload_attachment tool through MCP client authorization policies.
Audit Confluence and Jira attachments created since deployment for suspicious filenames or contents originating from MCP service accounts.

Patch Information

The fix is available in GitHub Release v0.22.0, landed via Pull Request #1448 and commit b041733. Details are in GitHub Security Advisory GHSA-h7wj-5v37-59r2. The patch introduces validate_safe_path to confine attachment sources to the workspace directory.

Workarounds

Run the MCP server as a low-privilege user in a dedicated working directory that contains no sensitive files.
Deploy the server inside a container or chroot with only the intended workspace mounted, denying read access to secrets, SSH keys, and environment files.
Disable the upload_attachment tool at the MCP client or gateway layer until the upgrade to 0.22.0 is complete.

bash

# Upgrade to the patched release
pip install --upgrade 'mcp-atlassian>=0.22.0'

# Verify installed version
python -c "import importlib.metadata; print(importlib.metadata.version('mcp-atlassian'))"