CVE-2026-77271: MCP Atlassian RCE Vulnerability

CVE-2026-77271 Overview

CVE-2026-77271 is a path traversal vulnerability [CWE-22] in MCP Atlassian, a Model Context Protocol (MCP) server that bridges AI clients with Atlassian Confluence and Jira. Versions prior to 0.22.0 ship a validate_safe_path helper that defaults its base directory to os.getcwd(). Confluence attachment call sites invoke the helper without supplying base_dir, letting attackers write attacker-selected files anywhere inside the working directory. Because the server process later imports Python modules from that directory, an attacker who overwrites a module file achieves code execution. The flaw bypasses the earlier remediation tracked as CVE-2026-27825.

Critical Impact
Authenticated attackers can overwrite Python modules within the MCP Atlassian working directory, achieving code execution when the modified module is imported.

Affected Products

MCP Atlassian versions prior to 0.22.0
Confluence attachment handlers within mcp_atlassian
Deployments exposing the MCP server to untrusted MCP clients

Discovery Timeline

2026-09-22 - CVE-2026-77271 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-77271

Vulnerability Analysis

MCP Atlassian exposes tool endpoints that let MCP clients upload and manipulate Confluence attachments. The validate_safe_path helper is the project's primary defense against directory traversal, but it treats its base_dir parameter as optional. When callers omit the argument, the helper falls back to os.getcwd(), which is the directory where the MCP server was launched.

The Confluence attachment call sites invoked the helper without a base_dir, so any traversal check was performed against the working directory rather than a locked-down attachment sandbox. An attacker controlling the file_path parameter can therefore write files anywhere inside the process working directory, including subpaths that map to installed Python packages.

Once a Python source file inside the working directory is overwritten, the modified code executes the next time the interpreter imports that module. This turns a file-write primitive into arbitrary code execution in the MCP server's process context and defeats the prior fix issued for CVE-2026-27825.

Root Cause

The defect is an [CWE-22] path traversal caused by a permissive default. validate_safe_path should require an explicit trusted base_dir, but the fallback to os.getcwd() combined with missing arguments at the attachment call sites collapsed the sandbox boundary onto the runtime working directory.

Attack Vector

An authenticated MCP client submits a Confluence attachment operation with a crafted file_path referencing a target Python module path relative to the working directory. The server writes attacker-controlled content to that path. When the application subsequently imports the overwritten module, the injected code runs with the server's privileges.

python

            return {"success": False, "error": "No file path provided"}

        try:
-            # Convert to absolute path if relative
-            if not os.path.isabs(file_path):
-                file_path = os.path.abspath(file_path)
+            # Confine the upload source to the workspace before it is read: reject
+            # traversal/absolute paths that escape CWD (arbitrary file read /
+            # exfiltration via a caller-supplied file_path).
+            file_path = str(validate_safe_path(file_path))

            # Check if file exists
            if not os.path.exists(file_path):

Source: GitHub Commit b041733

Detection Methods for CVE-2026-77271

Indicators of Compromise

Confluence attachment tool invocations containing .., absolute paths, or paths ending in .py within the file_path argument.
Unexpected modification timestamps on .py, .pyc, or __init__.py files inside the MCP Atlassian working directory.
New or altered Python modules whose contents do not match the installed package hashes from PyPI.

Detection Strategies

Log every MCP tool call that touches Confluence attachments and alert on file_path values that resolve outside the intended attachment sandbox.
Baseline the file integrity of the MCP Atlassian install directory and site-packages, then trigger on any drift.
Correlate attachment tool calls with subsequent child process creation or outbound network activity from the MCP server process.

Monitoring Recommendations

Track process lineage for the MCP Atlassian Python interpreter and alert on unexpected child processes.
Monitor the working directory of the MCP server for writes to files outside a designated uploads path.
Ship MCP server logs to a central SIEM and retain the raw file_path parameters for forensic review.

How to Mitigate CVE-2026-77271

Immediate Actions Required

Upgrade MCP Atlassian to version 0.22.0 or later, which enforces validate_safe_path at the attachment call sites.
Restart the MCP server after upgrade to ensure no previously overwritten modules remain loaded in memory.
Audit the working directory and installed packages for tampered Python files and reinstall the package from a trusted source if drift is detected.

Patch Information

The fix is delivered in MCP Atlassian v0.22.0 via Pull Request #1448 and commit b041733. See the GitHub Security Advisory GHSA-6vmq-24h2-pj7j for full details.

Workarounds

Run the MCP Atlassian server from a dedicated, read-only working directory that contains no Python source files.
Restrict which MCP clients can invoke Confluence attachment tools and require least-privilege API tokens.
Deploy the server under an OS user that lacks write permission to the Python site-packages directory.

bash

# Upgrade to the patched release
pip install --upgrade "mcp-atlassian>=0.22.0"

# Verify installed version
python -c "import mcp_atlassian, importlib.metadata as m; print(m.version('mcp-atlassian'))"