Executive brief
MCP Atlassian is a tool that integrates AI agents with Atlassian products (Jira and Confluence) via the Model Context Protocol. The upload_attachment functions in both modules lack path validation, allowing an authenticated attacker to read and exfiltrate arbitrary files from the server—including system passwords, API keys, OAuth tokens, and SSH keys—by uploading files from sensitive paths like /etc/passwd or /proc/self/environ.
Technical details
This is a path traversal vulnerability in the upload_attachment() functions of both the Jira and Confluence modules (mcp_atlassian/jira/attachments.py and mcp_atlassian/confluence/attachments.py). The functions accept a user-controlled file_path parameter and open the file for reading without calling validate_safe_path(), unlike the corresponding download functions which were protected in a prior fix (GHSA-xjgw-4wvw-rgm4). An authenticated MCP client can supply arbitrary paths (e.g., /etc/passwd, /proc/self/environ, ~/.mcp-atlassian/oauth-*.json) causing the server process to read and transmit the file's contents to the remote Atlassian instance as an attachment. No special privileges beyond standard MCP tool access are required. The vulnerability is reachable over the network in HTTP-mode deployments and locally in stdio-mode, affecting both jira_upload_attachment and confluence_upload_attachment MCP tools.
Affected products
- Atlassian MCP Atlassian up to v0.21.1
Timeline
- 2026-09-22: disclosed: GHSA-mfv2-4wvm-9pgp published
- 2026: other: CVE-2026-77266 assigned