CVE-2026-77270: Atlassian MCP arbitrary file read via upload attachment tools

CVE-2026-77270 · Severity: medium · CVSS 6.5 · Published 2026-09-22

MCP adapters for Atlassian Confluence and Jira contain path traversal vulnerabilities in file upload functions used by AI assistants to attach files to pages and issues. An authenticated attacker or AI assistant tricked via prompt injection can upload any file readable by the server process—such as SSH keys, environment credentials, or configuration files—to attacker-controlled Confluence pages or Jira issues, leading to credential theft and system compromise.

Technologies: mcp-atlassian (PyPI). Vendors: Atlassian, PyPI.

Quick answers

Is CVE-2026-77270 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77270 being exploited in the wild.
How severe is CVE-2026-77270?
Medium severity, with a CVSS score of 6.5, published 22 September 2026.
Which products and versions are affected?
Atlassian MCP Confluence affected versions not specified in advisory; Atlassian MCP Jira affected versions not specified in advisory; mcp-atlassian (PyPI) < 0.22.0, ECOSYSTEM:introduced=0,fixed=0.22.0.
Is there a fix for CVE-2026-77270?
Yes. mcp-atlassian (PyPI): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77270 attacked?
It is attacked over the network.
Am I affected by CVE-2026-77270?
Check whether you run Atlassian MCP Confluence, Atlassian MCP Jira or mcp-atlassian (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mcp-atlassian (PyPI): upgrade to 0.22.0 or later
    pip install "mcp-atlassian>=0.22.0"

Technical details

The vulnerability is a path traversal flaw in the upload_attachment methods of both Confluence (src/mcp_atlassian/confluence/attachments.py:35–108) and Jira (src/mcp_atlassian/jira/attachments.py:353–415) MCP server implementations. The upload functions accept file_path parameters and convert relative paths to absolute paths using os.path.abspath(), but fail to call the validate_safe_path() utility function that is correctly applied to download operations. This allows arbitrary files (e.g., /etc/passwd, ~/.ssh/id_rsa, .env) to be read and uploaded. The vulnerability requires authentication (enforced by @check_write_access decorator) and network access to the MCP server, but can be amplified via prompt injection if an AI assistant processes malicious Confluence/Jira content. The recommended fix is to call validate_safe_path() before reading the file in both upload methods, as already done for download operations.

Affected products

  • Atlassian MCP Confluence affected versions not specified in advisory
  • Atlassian MCP Jira affected versions not specified in advisory

Identifiers

  • CVE-2026-77270
  • GHSA-f26r-j276-ggg4
  • PYSEC-2026-4090

Timeline

  • 2026-09-22: disclosed: Published as GHSA-f26r-j276-ggg4
  • 2026-09-22: other: CVE-2026-77270 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.