CVE-2026-77262: sooperset mcp-atlassian path traversal in confluence_upload_attachment

CVE-2026-77262 · Severity: high · CVSS 8.6 · Published 2026-09-22

The mcp-atlassian MCP server allows remote attackers to read arbitrary files from the server's filesystem and exfiltrate them via fake Confluence uploads. Because the default deployment binds to all network interfaces with no authentication, any network-reachable attacker can exploit this without credentials. An attacker could steal sensitive files like credentials, private keys, or application secrets running under the server process.

Technologies: mcp-atlassian (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-77262 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77262 being exploited in the wild.
How severe is CVE-2026-77262?
High severity, with a CVSS score of 8.6, published 22 September 2026.
Which products and versions are affected?
mcp-atlassian (PyPI) < 0.22.0, ECOSYSTEM:introduced=0,fixed=0.22.0.
Is there a fix for CVE-2026-77262?
Yes. mcp-atlassian (PyPI): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77262 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-77262?
Check whether you run mcp-atlassian (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mcp-atlassian (PyPI): upgrade to 0.22.0 or later
    pip install "mcp-atlassian>=0.22.0"

Technical details

The `confluence_upload_attachment` MCP tool accepts a `file_path` parameter that is passed directly to `open(file_path, "rb")` without any path validation or sanitization (line 477 in attachments.py). This is a path traversal / arbitrary file read vulnerability (CWE-22). The attacker-controlled file path parameter reaches the open() sink end-to-end through the MCP tool handler, with no intermediate validation. The file contents are then streamed into a multipart upload directed at a Confluence host (which the attacker controls via environment configuration). In the default `streamable-http` transport, the server binds to 0.0.0.0 with no authentication, making this network-exploitable. This is an incomplete fix of a prior symmetric vulnerability (GHSA-xjgw-4wvw-rgm4) that patched the download/write path but missed the upload/read path. No patch is available at time of disclosure.

Affected products

  • sooperset mcp-atlassian >= 0.17.0

Identifiers

  • CVE-2026-77262
  • GHSA-p6hp-93wp-fh6p
  • PYSEC-2026-4099

Timeline

  • 2026-09-22: disclosed: Vulnerability advisory published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.