CVE-2026-77247: Sooperset MCP Atlassian arbitrary file upload to Jira/Confluence via unrestricted file paths

CVE-2026-77247 · Severity: high · CVSS 7.5 · Published 2026-09-22

Jira and Confluence attachment upload tools in the Atlassian MCP server accept file paths supplied by MCP clients and directly upload those files from the server's local filesystem. In HTTP or multi-user deployments, a malicious or compromised MCP client with upload permissions can read any file accessible to the server process—including configuration files, credentials, and secrets—and upload it to Jira or Confluence, causing disclosure of sensitive data.

Technologies: mcp-atlassian (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-77247 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77247 being exploited in the wild.
How severe is CVE-2026-77247?
High severity, with a CVSS score of 7.5, published 22 September 2026.
Which products and versions are affected?
mcp-atlassian (PyPI) < 0.22.0, ECOSYSTEM:introduced=0,fixed=0.22.0.
Is there a fix for CVE-2026-77247?
Yes. mcp-atlassian (PyPI): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77247 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-77247?
Check whether you run mcp-atlassian (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mcp-atlassian (PyPI): upgrade to 0.22.0 or later
    pip install "mcp-atlassian>=0.22.0"

Technical details

The vulnerability is an arbitrary file read and exfiltration flaw in MCP Atlassian's attachment upload tools (both Jira and Confluence). The root cause is that upload_attachment and upload_attachments methods accept caller-supplied file_path parameters, resolve them to absolute paths, and directly open and upload those files using the server process's privileges, without validating that paths are within an allowed directory. The attack vector is network-based in HTTP/SSE deployments: any MCP client with permission to invoke write/upload tools can specify an arbitrary file path (e.g., /etc/passwd, mounted secrets, configuration files) and cause the server to read and exfiltrate it. The vulnerability requires no prompt injection, user interaction, or prior network compromise; it is triggered by a normal MCP tool call. No patch information is provided in the advisory.

Affected products

  • Sooperset MCP Atlassian <UNKNOWN>

Identifiers

  • CVE-2026-77247
  • GHSA-f6pj-qv47-g96w
  • PYSEC-2026-4092

Timeline

  • 2026-09-22: disclosed: GHSA-f6pj-qv47-g96w published
  • 2026: other: CVE-2026-77247 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.