Executive brief
MCP Atlassian is a tool integration that allows automated creation and updates to Jira and Confluence issues. The attachment upload feature accepts local file paths without proper validation, allowing anyone with write access to the MCP server to read arbitrary files from the server and exfiltrate them to Atlassian. In HTTP or multi-user deployments, this could expose sensitive data like credentials, API tokens, source code, or configuration files.
Technical details
The vulnerability is a path traversal and arbitrary file read in the Jira and Confluence attachment upload implementations. Both tools accept user-supplied file_path parameters in the MCP server methods (confluence.py and jira.py) and pass them directly to attachment upload handlers without validation. The confluence/attachments.py and jira/attachments.py modules convert relative paths to absolute paths, verify existence, and then open files with open(file_path, "rb") without any path traversal checks or allowed directory restrictions. An authenticated MCP caller with write-tool access can supply paths to sensitive server files (/etc/passwd, environment files, mounted secrets, source code) which are then read by the process and uploaded to the configured Jira or Confluence instance. The attack requires the MCP server to be callable by the attacker (typically in HTTP or multi-user environments where untrusted callers can invoke write tools), but no additional user interaction or elevated privileges are needed. The decorators check READ_ONLY_MODE, so deployments with that flag set are protected; patched versions should add validate_safe_path() or directory allowlist checks.
Affected products
- MCP Atlassian MCP Atlassian before patched version (version not specified in advisory)
Timeline
- 2026-09-22: disclosed: Advisory published on GitHub
- 2026: other: CVE-2026-77253 assigned