Is CVE-2026-77260 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77260 being exploited in the wild.

How severe is CVE-2026-77260?

High severity, with a CVSS score of 4, published 22 September 2026.

Which products and versions are affected?

mcp-atlassian (PyPI) < 0.22.0, ECOSYSTEM:introduced=0,fixed=0.22.0.

Is there a fix for CVE-2026-77260?

Yes. mcp-atlassian (PyPI): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77260 attacked?

It is attacked over the network.

Am I affected by CVE-2026-77260?

Check whether you run mcp-atlassian (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77260: Atlassian MCP Server arbitrary file read via unconstrained upload_attachment path

Q: Is there a fix for CVE-2026-77260?

Yes. mcp-atlassian (PyPI): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-77260 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-77260?

Check whether you run mcp-atlassian (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77260 · Severity: high · CVSS 4 · Published 2026-09-22

The Atlassian MCP Server (used to connect AI agents to Confluence and Jira) allows attackers to read any file accessible to the server process—such as SSH keys, environment files, or cloud credentials—by uploading them as attachments. An attacker can either inject malicious commands into Jira/Confluence pages that an agent reads, or directly call the vulnerable tool if the HTTP endpoint is exposed. This enables credential theft and complete compromise of cloud accounts and systems the server has access to.

Technologies: mcp-atlassian (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-77260 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77260 being exploited in the wild.
How severe is CVE-2026-77260?: High severity, with a CVSS score of 4, published 22 September 2026.
Which products and versions are affected?: mcp-atlassian (PyPI) < 0.22.0, ECOSYSTEM:introduced=0,fixed=0.22.0.
Is there a fix for CVE-2026-77260?: Yes. mcp-atlassian (PyPI): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77260 attacked?: It is attacked over the network.
Am I affected by CVE-2026-77260?: Check whether you run mcp-atlassian (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mcp-atlassian (PyPI): upgrade to 0.22.0 or later
```
pip install "mcp-atlassian>=0.22.0"
```

Technical details

This is an arbitrary file read vulnerability in the `upload_attachment` tool for both Confluence and Jira. The vulnerable code in `src/mcp_atlassian/confluence/attachments.py` (lines 62–78, 477) and `src/mcp_atlassian/jira/attachments.py` (lines 374–386) accepts a user-supplied `file_path` parameter and opens it with `open(file_path, "rb")` without validating that the path is within a safe base directory. Although `os.path.abspath()` is called, it does not restrict paths to a safe root; an attacker can supply absolute paths like `/etc/shadow`, `/root/.ssh/id_rsa`, or `~/.aws/credentials`. The symmetric download paths were patched for CVE-2026-27825 with `validate_safe_path()`, but the upload paths were overlooked. An unauthenticated attacker reaching a non-loopback HTTP endpoint, or a threat actor injecting prompts into Jira/Confluence pages that an LLM agent reads, can trigger file exfiltration. The fix is to wrap `file_path` through `validate_safe_path()` with a configured upload base directory before opening the file.

Affected products

Atlassian MCP Server main branch as of 2026-04-21

Identifiers

CVE-2026-77260
GHSA-f4p7-qx46-wc5j
PYSEC-2026-4091

Timeline

2026-09-22: disclosed: GHSA-f4p7-qx46-wc5j published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.