CVE-2026-77270: MCP Atlassian Path Traversal Vulnerability

CVE-2026-77270 Overview

CVE-2026-77270 is a path traversal vulnerability [CWE-22] in MCP Atlassian, a Model Context Protocol (MCP) server that bridges AI assistants with Atlassian products such as Confluence and Jira. Versions prior to 0.22.0 treat caller-controlled file_path values passed to the Jira and Confluence attachment upload tools as trusted server-local paths. An MCP caller with upload access can supply an arbitrary absolute or traversal path, causing the server to read and exfiltrate any file readable by the server process to a Confluence page or Jira issue. The maintainer released a fix in version 0.22.0.

Critical Impact
Authenticated MCP callers can read arbitrary files on the MCP Atlassian server host by supplying crafted file_path values to confluence_upload_attachment or jira_upload_attachment, then retrieving the uploaded content from Atlassian.

Affected Products

MCP Atlassian (Confluence connector) prior to 0.22.0
MCP Atlassian (Jira connector) prior to 0.22.0
Deployments exposing confluence_upload_attachment or jira_upload_attachment MCP tools

Discovery Timeline

2026-09-22 - CVE-2026-77270 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77270

Vulnerability Analysis

MCP Atlassian exposes two attachment upload tools, confluence_upload_attachment and jira_upload_attachment, that accept a file_path parameter from the MCP caller. The server converts relative paths to absolute paths and invokes open(file_path, "rb") to stream the file contents to the Atlassian REST API. No confinement check restricts the resolved path to a workspace or allowlisted directory.

A caller with valid MCP credentials and upload access can specify paths such as /etc/passwd, ../../.env, or process credential files. The server reads those files under its own process identity and attaches them to a chosen Confluence page or Jira issue. The attacker then retrieves the attachment through normal Atlassian workflows, completing exfiltration.

The impact scales with the privileges of the MCP server process. Servers running with access to configuration files, cloud credentials, private keys, or user home directories expose those secrets to any authorized MCP client.

Root Cause

The vulnerable code path trusts caller-supplied file paths without validating that they resolve inside an approved working directory. Absolute paths and .. traversal sequences bypass any implicit workspace assumption. The advisory identifies confluence_upload_attachment, jira_upload_attachment, file_path, and open(file_path, "rb") as the affected entry points and sinks.

Attack Vector

Exploitation requires network access to the MCP server and low-privilege authenticated access to invoke upload tools. No user interaction is needed. The attacker calls the upload tool with a target path, waits for the upload to complete, then downloads the attached file from Atlassian.

python

# Patch excerpt: src/mcp_atlassian/confluence/attachments.py
            return {"success": False, "error": "No file path provided"}

        try:
-            # Convert to absolute path if relative
-            if not os.path.isabs(file_path):
-                file_path = os.path.abspath(file_path)
+            # Confine the upload source to the workspace before it is read: reject
+            # traversal/absolute paths that escape CWD (arbitrary file read /
+            # exfiltration via a caller-supplied file_path).
+            file_path = str(validate_safe_path(file_path))

            # Check if file exists
            if not os.path.exists(file_path):

Source: GitHub Commit b041733. The fix introduces validate_safe_path to reject absolute paths and traversal sequences that escape the current working directory.

Detection Methods for CVE-2026-77270

Indicators of Compromise

Attachment upload API calls to Confluence or Jira originating from the MCP Atlassian service account with unusual file names such as passwd, .env, id_rsa, or config.yaml.
MCP server logs recording file_path arguments containing absolute paths outside the deployment workspace or .. sequences.
Confluence page or Jira issue attachments created by the MCP integration account that match sensitive filename patterns.

Detection Strategies

Inspect MCP Atlassian request logs for confluence_upload_attachment and jira_upload_attachment invocations, flagging any file_path values that resolve outside the intended workspace directory.
Correlate Atlassian audit logs with MCP server logs to identify attachments uploaded by the MCP service account within seconds of tool invocations from untrusted clients.
Baseline the set of directories the MCP server legitimately reads from, and alert on open() calls targeting paths outside that baseline.

Monitoring Recommendations

Forward MCP server stdout, stderr, and structured audit logs into a centralized log platform for retention and query.
Monitor filesystem access on the MCP host using auditd or eBPF-based tooling to detect reads of sensitive files by the MCP process.
Alert on newly created Atlassian attachments whose MIME type or content signature indicates configuration files, key material, or shell history.

How to Mitigate CVE-2026-77270

Immediate Actions Required

Upgrade MCP Atlassian to version 0.22.0 or later, which introduces validate_safe_path to confine uploads to the working directory.
Rotate any credentials, tokens, or private keys stored on hosts running vulnerable MCP Atlassian versions, since prior reads may have exfiltrated them.
Review Confluence and Jira attachments uploaded by the MCP service account since deployment and remove any containing sensitive host data.

Patch Information

The fix is released in MCP Atlassian v0.22.0 via Pull Request #1448 and commit b041733. Full details are documented in the GitHub Security Advisory GHSA-f26r-j276-ggg4.

Workarounds

Run the MCP Atlassian server as an unprivileged user with a minimal home directory and no access to secrets, credentials, or configuration files.
Deploy the server inside a container or sandbox whose filesystem contains only the intended upload workspace.
Restrict MCP client authentication so that only trusted, audited callers can invoke confluence_upload_attachment and jira_upload_attachment.

bash

# Upgrade to the patched release
pip install --upgrade 'mcp-atlassian>=0.22.0'

# Verify the installed version
python -c "import importlib.metadata; print(importlib.metadata.version('mcp-atlassian'))"

# Run the server as a dedicated low-privilege user inside a scoped workspace
useradd -r -s /usr/sbin/nologin mcpatlassian
install -d -o mcpatlassian -g mcpatlassian /srv/mcp-atlassian/workspace
cd /srv/mcp-atlassian/workspace && sudo -u mcpatlassian mcp-atlassian