# CVE-2026-77255: Atlassian MCP arbitrary file read via path traversal in update_issue

Source: https://junglewise.ai/threats/cve-2026-77255-atlassian-mcp-arbitrary-file-read-via-path-traversal-in-update  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77255 · Severity: high · CVSS 8.6 · Published 2026-09-22

Atlassian's Model Context Protocol (MCP) server for Jira contains a file read vulnerability that allows an AI agent to extract sensitive files and credentials from the host system. By crafting malicious file paths in the update_issue tool, an attacker can bypass sandbox restrictions and steal environment variables, API tokens, SSH keys, and configuration files—escalating from a restricted AI context to full system compromise.

Technologies: [mcp-atlassian (PyPI)](https://junglewise.ai/threats/technologies/mcp-atlassian). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-77255 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77255 being exploited in the wild.

**How severe is CVE-2026-77255?** High severity, with a CVSS score of 8.6, published 22 September 2026.

**Which products and versions are affected?** mcp-atlassian (PyPI) < 0.22.0, ECOSYSTEM:introduced=0,fixed=0.22.0.

**Is there a fix for CVE-2026-77255?** Yes. mcp-atlassian (PyPI): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77255 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-77255?** Check whether you run mcp-atlassian (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mcp-atlassian (PyPI): upgrade to 0.22.0 or later

  ```sh
  pip install "mcp-atlassian>=0.22.0"
  ```


## Technical details

The vulnerability is a Confused Deputy attack in the MCP server's update_issue tool handler. The attachments parameter accepts file paths without sanitization, allowing absolute paths (starting with /), directory traversal sequences (../), and access to protected system files. The MCP server typically runs with higher privileges and broader filesystem access than the restricted AI agent, enabling it to read files the agent itself cannot access—such as /proc/self/environ (containing JIRA_API_TOKEN and other secrets) and host configuration files. An unauthenticated AI agent can invoke update_issue with arbitrary file paths, causing the privileged MCP process to read and attach those files to a Jira ticket, resulting in credential and configuration exfiltration. No input validation or path restriction is performed before the Jira API upload.

## Affected products

- Atlassian MCP Server <UNKNOWN>

## Identifiers

- CVE-2026-77255
- GHSA-2xj6-xx86-cwwc
- PYSEC-2026-4080

## Timeline

- 2026-09-22: disclosed: Vulnerability advisory published

## Related threats

- [Atlassian MCP reflected XSS in OAuth setup callback handler](https://junglewise.ai/threats/cve-2026-77272-atlassian-mcp-reflected-xss-in-oauth-setup-callback-handler)
- [Atlassian MCP path traversal in upload_attachment allows arbitrary file read](https://junglewise.ai/threats/cve-2026-77269-atlassian-mcp-path-traversal-in-upload-attachment-allows)
- [Atlassian MCP insecure OAuth token file permissions](https://junglewise.ai/threats/cve-2026-77268-atlassian-mcp-insecure-oauth-token-file-permissions)
- [MCP Atlassian path traversal in upload_attachment](https://junglewise.ai/threats/cve-2026-77266-mcp-atlassian-path-traversal-in-upload-attachment)
- [sooperset mcp-atlassian path traversal in confluence_upload_attachment](https://junglewise.ai/threats/cve-2026-77262-sooperset-mcp-atlassian-path-traversal-in-confluence-upload)