Is CVE-2026-77257 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77257 being exploited in the wild.

How severe is CVE-2026-77257?

High severity, with a CVSS score of 4, published 22 September 2026.

Which products and versions are affected?

mcp-atlassian (PyPI) < 0.22.0, ECOSYSTEM:introduced=0,fixed=0.22.0.

Is there a fix for CVE-2026-77257?

Yes. mcp-atlassian (PyPI): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77257 attacked?

It is attacked over the network.

Am I affected by CVE-2026-77257?

Check whether you run mcp-atlassian (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77257: sooperset mcp-atlassian arbitrary local file read in HTTP upload

Q: Is there a fix for CVE-2026-77257?

Yes. mcp-atlassian (PyPI): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-77257 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-77257?

Check whether you run mcp-atlassian (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77257 · Severity: high · CVSS 4 · Published 2026-09-22

mcp-atlassian is a Model Context Protocol server that integrates Jira and Confluence with AI agents. When deployed as an HTTP service (documented as first-class), the Confluence and Jira attachment upload tools accept arbitrary server-local file paths without validation, allowing authenticated users or prompt-injected agents to read and exfiltrate any file the server process can access—including environment variables, API tokens, and service secrets. In containerized deployments with mounted credentials, this enables disclosure of sensitive operator-managed secrets.

Technologies: mcp-atlassian (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-77257 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77257 being exploited in the wild.
How severe is CVE-2026-77257?: High severity, with a CVSS score of 4, published 22 September 2026.
Which products and versions are affected?: mcp-atlassian (PyPI) < 0.22.0, ECOSYSTEM:introduced=0,fixed=0.22.0.
Is there a fix for CVE-2026-77257?: Yes. mcp-atlassian (PyPI): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77257 attacked?: It is attacked over the network.
Am I affected by CVE-2026-77257?: Check whether you run mcp-atlassian (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mcp-atlassian (PyPI): upgrade to 0.22.0 or later
```
pip install "mcp-atlassian>=0.22.0"
```

Technical details

This is a path-traversal / arbitrary file read vulnerability in the upload-source validation logic. The vulnerability exists in two code paths: `src/mcp_atlassian/confluence/attachments.py:62-80,477` (Confluence) and `src/mcp_atlassian/jira/attachments.py:372-389` (Jira). Both accept caller-supplied file paths, convert relative paths to absolute without containment, verify file existence, and read the file for multipart upload to Atlassian—all without applying `validate_safe_path` containment checks. The codebase already implements `validate_safe_path` for download-destination paths to prevent writes outside a base directory, but this same check is omitted on the upload-source side. Attack vector is network (HTTP/SSE transport) with authentication; precondition is HTTP deployment exposure and write-tool access. An attacker can read any file accessible to the MCP process, including `.env` files with credentials and service secrets. Patch is pending; mitigation is to require `READ_ONLY_MODE=true` or disable HTTP upload tools.

Affected products

sooperset mcp-atlassian all versions prior to patch

Identifiers

CVE-2026-77257
GHSA-mrq8-fv7v-hhjg
PYSEC-2026-4098

Timeline

2026-09-22: disclosed: Advisory GHSA-mrq8-fv7v-hhjg published
2026-05-05: advisory: Vulnerability discovery date

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.