CVE-2026-77253: MCP Atlassian arbitrary file read in attachment upload

CVE-2026-77253 · Severity: high · CVSS 7.1 · Published 2026-09-22

MCP Atlassian is a tool integration that allows automated creation and updates to Jira and Confluence issues. The attachment upload feature accepts local file paths without proper validation, allowing anyone with write access to the MCP server to read arbitrary files from the server and exfiltrate them to Atlassian. In HTTP or multi-user deployments, this could expose sensitive data like credentials, API tokens, source code, or configuration files.

Technologies: mcp-atlassian (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-77253 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77253 being exploited in the wild.
How severe is CVE-2026-77253?
High severity, with a CVSS score of 7.1, published 22 September 2026.
Which products and versions are affected?
mcp-atlassian (PyPI) < 0.22.0, ECOSYSTEM:introduced=0,fixed=0.22.0.
Is there a fix for CVE-2026-77253?
Yes. mcp-atlassian (PyPI): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77253 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-77253?
Check whether you run mcp-atlassian (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mcp-atlassian (PyPI): upgrade to 0.22.0 or later
    pip install "mcp-atlassian>=0.22.0"

Technical details

The vulnerability is a path traversal and arbitrary file read in the Jira and Confluence attachment upload implementations. Both tools accept user-supplied file_path parameters in the MCP server methods (confluence.py and jira.py) and pass them directly to attachment upload handlers without validation. The confluence/attachments.py and jira/attachments.py modules convert relative paths to absolute paths, verify existence, and then open files with open(file_path, "rb") without any path traversal checks or allowed directory restrictions. An authenticated MCP caller with write-tool access can supply paths to sensitive server files (/etc/passwd, environment files, mounted secrets, source code) which are then read by the process and uploaded to the configured Jira or Confluence instance. The attack requires the MCP server to be callable by the attacker (typically in HTTP or multi-user environments where untrusted callers can invoke write tools), but no additional user interaction or elevated privileges are needed. The decorators check READ_ONLY_MODE, so deployments with that flag set are protected; patched versions should add validate_safe_path() or directory allowlist checks.

Affected products

  • MCP Atlassian MCP Atlassian before patched version (version not specified in advisory)

Identifiers

  • CVE-2026-77253
  • GHSA-vc25-24vv-fxxm
  • PYSEC-2026-4101

Timeline

  • 2026-09-22: disclosed: Advisory published on GitHub
  • 2026: other: CVE-2026-77253 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.