AI Threat AlertCVE-2026-77255: mcp-atlassian: arbitrary file read/exfil via attachments
GHSA-2xj6-xx86-cwwcHIGHCISA: TRACK*mcp-atlassian (pip) before 0.22.0 lets an AI agent pass arbitrary absolute paths to the update_issue attachments parameter, so the privileged MCP process reads any file it can access and uploads it to a Jira ticket. This is a confused-deputy flaw: a sandboxed agent, or an attacker steering one through prompt injection, can steal the MCP server's own environment (including JIRA_API_TOKEN via /proc/self/environ), SSH keys and agent config files holding other service tokens. Exploitation likelihood is modest today (EPSS 0.4%, top 67%, no public exploit, no Nuclei template, not in KEV, SSVC Track*), and only one downstream dependent is tracked, but the PoC is trivial and the package has 38 other CVEs, which signals weak security hygiene. Upgrade to 0.22.0 now, rotate any tokens that were in the MCP server's environment if untrusted agents or content could reach it, and review Jira attachment history for unexpected system files.
What is the risk?
High (CVSS 8.6, scope changed, confidentiality impact only). No authentication is needed at the vulnerability level, and exploitation is a single tool call with a file path. Real-world risk depends on who can drive the agent: any agent exposed to untrusted input (tickets, emails, web content) can be hijacked via indirect prompt injection into triggering the exfiltration. Exploitation signals are low at present (EPSS 0.4%, no public exploit, not in KEV), so urgency is high-priority patching rather than emergency response. The blast radius is every secret and file readable by the MCP server's OS user.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| MCP Atlassian | pip | < 0.22.0 | 0.22.0 |
Do you use MCP Atlassian? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade mcp-atlassian to 0.22.0 or later (pip install -U mcp-atlassian). 2) Rotate JIRA_API_TOKEN and any secrets present in the MCP server's environment or readable by its user if the server ran an affected version with untrusted agents or inputs. 3) Run the MCP server as a dedicated low-privilege user or in a container with a minimal filesystem and no mounted secrets or home directories. 4) Until patched, disable or deny the update_issue tool's attachments parameter at the MCP client or gateway level, and require human approval for write tools. 5) Detection: audit Jira issues for attachments named environ, config.yaml, id_rsa, .env or similar, review MCP tool-call logs for update_issue calls with absolute paths or ../ sequences, and monitor Jira token use from unexpected IPs.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-77255?
mcp-atlassian (pip) before 0.22.0 lets an AI agent pass arbitrary absolute paths to the update_issue attachments parameter, so the privileged MCP process reads any file it can access and uploads it to a Jira ticket. This is a confused-deputy flaw: a sandboxed agent, or an attacker steering one through prompt injection, can steal the MCP server's own environment (including JIRA_API_TOKEN via /proc/self/environ), SSH keys and agent config files holding other service tokens. Exploitation likelihood is modest today (EPSS 0.4%, top 67%, no public exploit, no Nuclei template, not in KEV, SSVC Track*), and only one downstream dependent is tracked, but the PoC is trivial and the package has 38 other CVEs, which signals weak security hygiene. Upgrade to 0.22.0 now, rotate any tokens that were in the MCP server's environment if untrusted agents or content could reach it, and review Jira attachment history for unexpected system files.
Is CVE-2026-77255 actively exploited?
No confirmed active exploitation of CVE-2026-77255 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-77255?
1) Upgrade mcp-atlassian to 0.22.0 or later (pip install -U mcp-atlassian). 2) Rotate JIRA_API_TOKEN and any secrets present in the MCP server's environment or readable by its user if the server ran an affected version with untrusted agents or inputs. 3) Run the MCP server as a dedicated low-privilege user or in a container with a minimal filesystem and no mounted secrets or home directories. 4) Until patched, disable or deny the update_issue tool's attachments parameter at the MCP client or gateway level, and require human approval for write tools. 5) Detection: audit Jira issues for attachments named environ, config.yaml, id_rsa, .env or similar, review MCP tool-call logs for update_issue calls with absolute paths or ../ sequences, and monitor Jira token use from unexpected IPs.
What systems are affected by CVE-2026-77255?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling agents, developer assistant integrations.
What is the CVSS score for CVE-2026-77255?
CVE-2026-77255 has a CVSS v3.1 base score of 8.6 (HIGH). The EPSS exploitation probability is 0.46%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0037Data from Local SystemAML.T0053AI Agent Tool InvocationAML.T0083Credentials from AI Agent ConfigurationAML.T0086Exfiltration via AI Agent Tool InvocationAML.T0098AI Agent Tool Credential HarvestingCompliance Controls Affected
What are the technical details?
Original Advisory
### Summary A critical Confused Deputy (Arbitrary File Read & Exfiltration) vulnerability in the Atlassian MCP server (Python) allows an AI agent to exfiltrate sensitive host files and environment secrets. By providing absolute system paths to the attachments parameter of the update_issue tool, an agent can force the privileged MCP process to read and upload any file it has access to—including its own environment variables and host configuration—directly to a Jira ticket. ### Details The vulnerability is located in the update_issue tool handler. The attachments parameter accepts a list of file paths that are passed directly to the Jira API's upload method without any sanitization or validation. Specifically, the implementation fails to: 1. Restrict paths to a safe workspace: It accepts absolute paths starting with /. 2. Prevent directory traversal: It does not filter for ../ sequences. 3. Validate ownership: It allows the process to read system-level files (like /proc/self/environ) that the calling agent is normally forbidden from accessing due to sandbox restrictions. Because the MCP server typically runs with higher privileges than the AI agent (holding the JIRA_API_TOKEN and having wider filesystem access), it acts as a "Confused Deputy," performing exfiltration on behalf of a restricted agent. ### PoC To reproduce the vulnerability in an environment where the agent is sandboxed (e.g., as a restricted Unix user) but the MCP server has host-level access: 1. Exfiltrate MCP Secrets: The agent calls the update_issue tool with the following payload: { "issue_key": "SECURITY-1", "attachments": ["/proc/self/environ"] } Result: The MCP server reads its own process environment—containing the JIRA_API_TOKEN and other sensitive keys in plain text—and attaches it to the Jira issue. 2. Exfiltrate Host Configuration: The agent calls the tool to target global assistant settings: { "issue_key": "SECURITY-1", "attachments": ["/home/hermes/.hermes/config.yaml"] } Result: The host's global configuration file (containing tokens for GitLab, Slack, and other services) is successfully exfiltrated to the cloud. ### Impact * Critical Credential Theft: Immediate exposure of the JIRA_API_TOKEN and any other secrets injected into the MCP server's environment. * Arbitrary File Access: Total exfiltration of any data the host user running the MCP server can read (SSH keys, databases, local source code). * Privilege Escalation & Lateral Movement: Attackers can move from a restricted AI sandbox to full host-system control by stealing tokens or configuration files.
Exploitation Scenario
An attacker plants a malicious instruction in a Jira comment, a support email, or a web page that a company's AI assistant processes. The injected prompt tells the agent to call update_issue on a ticket with attachments set to /proc/self/environ and the agent's config file. The mcp-atlassian server, running with higher privileges than the sandboxed agent, reads the files and uploads them to the Jira ticket. The attacker, or anyone with ticket access, downloads the attachment, extracts the Jira token and other service credentials, and uses them to move laterally into Jira, GitLab, Slack and the host.
Weaknesses (CWE)
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')PrimaryCWE-441Unintended Proxy or Intermediary ('Confused Deputy')PrimaryCWE-22Improper Limitation of a Pathname to a Restricted DirectoryCWE-441Unintended Proxy or IntermediaryCWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-7724410.0MCP Atlassian: unauthenticated access to operator Jira/Confluence
Same package: mcp-atlassianCVE-2026-772549.1MCP Atlassian: missing auth exposes Jira/Confluence
Same package: mcp-atlassianCVE-2026-278259.1mcp-atlassian: Path Traversal enables file access
Same package: mcp-atlassianCVE-2026-772438.8MCP Atlassian: missing authz lets clients call hidden tools
Same package: mcp-atlassianCVE-2026-772628.6mcp-atlassian: path traversal enables arbitrary file read
Same package: mcp-atlassian