AI Threat AlertCVE-2026-77257: mcp-atlassian: arbitrary local file upload via path
GHSA-mrq8-fv7v-hhjgHIGHPoC AVAILABLEmcp-atlassian, an MCP server that lets AI agents work with Jira and Confluence, accepts caller-supplied server-local file paths in its attachment tools without restricting them to an upload directory. An authenticated MCP caller, or an agent steered by prompt injection, can make the server read any file its process can access (such as a mounted .env or token file) and attach it to a Jira issue or Confluence page using the configured Atlassian credentials. Exploitation likelihood is low-to-moderate (EPSS 0.00386, top 69th percentile), there is no public exploit or Nuclei template, it is not in CISA KEV, and SSVC says TRACK. Blast radius is small by dependents (1), but the package has 38 other CVEs, and the risk is highest in shared HTTP/SSE deployments that bind 0.0.0.0 with write tools enabled. Upgrade to mcp-atlassian 0.22.0 or later, and until then enable READ_ONLY_MODE=true, limit exposed toolsets, and keep secrets out of the container filesystem.
What is the risk?
Medium-to-High depending on deployment. Exploitation is straightforward once an attacker can reach a write tool (low complexity, authentication or agent access required), and it is not RCE. Exposure is greatest for multi-user HTTP/streamable deployments, which default to HOST=0.0.0.0 and enable all toolsets unless TOOLSETS is set. Single-user stdio use with tightly scoped tokens is lower risk. Exploitation signals are weak: no KEV listing, no public exploit, EPSS 0.386%.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| MCP Atlassian | pip | < 0.22.0 | 0.22.0 |
Do you use MCP Atlassian? You're affected.
How severe is it?
What should I do?
1 step1) Upgrade mcp-atlassian to 0.22.0 or later (PR #1448). 2) Where patching is delayed, set READ_ONLY_MODE=true to block write tools and restrict TOOLSETS to the minimum needed. 3) Do not expose the HTTP/SSE endpoint on 0.0.0.0 without authentication and network controls. 4) Run the container with a minimal filesystem, avoid mounting .env or token files, and use a read-only root filesystem and secrets managers instead. 5) Use least-privilege Atlassian tokens scoped to required projects. 6) Detection: audit Jira and Confluence for unexpected attachments (for example .env, passwd, key files), review MCP tool-call logs for jira_update_issue attachments and Confluence upload calls with absolute or ../ paths, and rotate any credentials that may have been exposed.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-77257?
mcp-atlassian, an MCP server that lets AI agents work with Jira and Confluence, accepts caller-supplied server-local file paths in its attachment tools without restricting them to an upload directory. An authenticated MCP caller, or an agent steered by prompt injection, can make the server read any file its process can access (such as a mounted .env or token file) and attach it to a Jira issue or Confluence page using the configured Atlassian credentials. Exploitation likelihood is low-to-moderate (EPSS 0.00386, top 69th percentile), there is no public exploit or Nuclei template, it is not in CISA KEV, and SSVC says TRACK. Blast radius is small by dependents (1), but the package has 38 other CVEs, and the risk is highest in shared HTTP/SSE deployments that bind 0.0.0.0 with write tools enabled. Upgrade to mcp-atlassian 0.22.0 or later, and until then enable READ_ONLY_MODE=true, limit exposed toolsets, and keep secrets out of the container filesystem.
Is CVE-2026-77257 actively exploited?
Proof-of-concept exploit code is publicly available for CVE-2026-77257, increasing the risk of exploitation.
How to fix CVE-2026-77257?
1) Upgrade mcp-atlassian to 0.22.0 or later (PR #1448). 2) Where patching is delayed, set READ_ONLY_MODE=true to block write tools and restrict TOOLSETS to the minimum needed. 3) Do not expose the HTTP/SSE endpoint on 0.0.0.0 without authentication and network controls. 4) Run the container with a minimal filesystem, avoid mounting .env or token files, and use a read-only root filesystem and secrets managers instead. 5) Use least-privilege Atlassian tokens scoped to required projects. 6) Detection: audit Jira and Confluence for unexpected attachments (for example .env, passwd, key files), review MCP tool-call logs for jira_update_issue attachments and Confluence upload calls with absolute or ../ paths, and rotate any credentials that may have been exposed.
What systems are affected by CVE-2026-77257?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling agents, multi-user HTTP/SSE agent deployments.
What is the CVSS score for CVE-2026-77257?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0037Data from Local SystemAML.T0051.001IndirectAML.T0053AI Agent Tool InvocationAML.T0086Exfiltration via AI Agent Tool InvocationAML.T0098AI Agent Tool Credential HarvestingCompliance Controls Affected
What are the technical details?
Original Advisory
# sooperset/mcp-atlassian: HTTP upload tools can attach arbitrary server-local files Date: 2026-05-05 Target: `sooperset/mcp-atlassian` Commit: `d8bc78698a63cb6b321c7ca796d6329d448f7f6d` ## Summary `mcp-atlassian` supports HTTP/SSE deployment for persistent, remote, and multi-user use. In that mode, write-capable Jira and Confluence attachment flows accept caller-controlled server-local file paths and read those paths without an upload-source allowlist or base directory restriction. An authenticated caller, or a prompt-injected agent with tool-call capability, can cause the MCP server process to read a local file it can access and attach that file into a Jira issue or Confluence page using configured Atlassian credentials. This is distinct from the prior download-path advisory: that issue was an arbitrary file write sink. This path is upload-source local file disclosure. ## Impact Impact is local file disclosure through an authenticated Atlassian attachment write. In Docker/Kubernetes deployments that mount `.env` or token material into the service, exposed files may include API tokens, OAuth credentials, service configuration, or other local secrets readable by the MCP process. The issue is bounded by tool access and Atlassian permissions: the attacker needs an MCP call path to a write tool and an issue/page where the attachment can be written. It is not direct RCE. Severity is Medium-to-High depending on deployment: - Medium for single-user/local stdio usage or tightly scoped tokens. - High where HTTP/streamable deployments are shared, write tools are exposed, and the server has access to secrets or broad filesystem mounts. ## Source Evidence HTTP/multi-user deployment is first-class: - `docs/http-transport.mdx:1-7` describes running as a persistent HTTP service for multi-user and remote deployment. - `docs/http-transport.mdx:10-13` lists SSE and streamable-http endpoints. - `docs/http-transport.mdx:88-90` says both HTTP transports support per-request authentication. - `docs/advanced/docker-production.mdx:25-37` shows Docker deployment with `.env`, exposed ports, and `HOST=0.0.0.0`. - `docs/advanced/docker-production.mdx:91-103` shows Atlassian credentials stored in `.env`. - `src/mcp_atlassian/__init__.py:359-363` defaults HTTP host to `0.0.0.0` unless overridden. The Confluence upload path reads caller-chosen server-local files: - `src/mcp_atlassian/servers/confluence.py:1290-1315` exposes `file_path` and explicitly accepts absolute or relative paths. - `src/mcp_atlassian/servers/confluence.py:1356-1363` passes `file_path` to `confluence_fetcher.upload_attachment`. - `src/mcp_atlassian/confluence/attachments.py:62-70` only converts relative paths to absolute and checks existence. - `src/mcp_atlassian/confluence/attachments.py:77-80` passes the path to `_upload_attachment_direct`. - `src/mcp_atlassian/confluence/attachments.py:477` opens `file_path` for the multipart upload. The Jira update path can also upload caller-chosen server-local files: - `src/mcp_atlassian/servers/jira.py:1564-1568` exposes `jira_update_issue` as a write tool in `toolset:jira_issues`. - `src/mcp_atlassian/servers/jira.py:1609-1618` accepts `attachments` as a JSON array or comma-separated list of file paths. - `src/mcp_atlassian/servers/jira.py:1648-1674` parses those file paths and adds them to the update payload. - `src/mcp_atlassian/jira/issues.py:1132-1137` forwards `attachments` to `upload_attachments`. - `src/mcp_atlassian/jira/attachments.py:372-389` converts relative paths to absolute, checks existence, opens the path, and passes it to `jira.add_attachment`. Existing controls do not authorize the upload source path: - `src/mcp_atlassian/utils/decorators.py:45-72` blocks writes only when read-only mode is enabled. - `src/mcp_atlassian/servers/main.py:276-279` filters write tools out of listing only in read-only mode. - `src/mcp_atlassian/utils/toolsets.py:158-183` currently enables all toolsets when `TOOLSETS` is unset. - `docs/advanced/docker-production.mdx:109-119` documents `READ_ONLY_MODE=true` as an optional production hardening setting, not a default. - `src/mcp_atlassian/confluence/attachments.py:217-223` and `src/mcp_atlassian/jira/attachments.py:37-43` show `validate_safe_path` exists for download destinations, but no equivalent upload-source containment is applied. ## Root cause The codebase already has a path-containment primitive (`validate_safe_path`) and applies it to download destinations to prevent writes outside a configured base directory — that is, it correctly defends the filesystem-write side of the boundary. But the upload-source side of the same boundary is not defended at all: the Confluence and Jira attachment paths convert caller-supplied paths to absolute, check that the file exists, open it, and stream the bytes to Atlassian, with no equivalent "must resolve inside an upload base directory" check. The authorization model implicitly treats "the MCP process can read this file" as equivalent to "the MCP caller is authorized to upload this file," which is correct only for single-user stdio mode. For HTTP/SSE multi-user mode (which the project documents as first-class and ships with `HOST=0.0.0.0`), it is not — caller identity and process filesystem-read capability are different boundaries. The structural fix is to apply the existing `validate_safe_path` containment primitive to upload-source paths under a separate `UPLOAD_BASE_DIR` configuration, and to disable server-local upload tools by default in HTTP transport mode unless that base directory is configured. ## Auth boundary violated **Boundary:** Per-user resource ownership (in HTTP/SSE multi-user mode, an authenticated MCP caller's tool surface should expose only files the caller is authorized to upload — not arbitrary files in the MCP process's filesystem view, including operator-mounted secrets and other tenants' data). **Respected at:** `src/mcp_atlassian/confluence/attachments.py:217-223` and `src/mcp_atlassian/jira/attachments.py:37-43` (`validate_safe_path` is correctly applied to download-destination paths to prevent writes outside a base directory). **Violated at:** `src/mcp_atlassian/confluence/attachments.py:62-70,77-80,477` (Confluence upload path: relative-to-absolute conversion, existence check, then `open(file_path)`, with no `validate_safe_path` call against an upload base directory) and `src/mcp_atlassian/jira/attachments.py:372-389` (Jira upload path: identical pattern). The boundary is silently dropped: the same containment primitive that defends the download side is not invoked on the upload side. ## Reproduction Observed: ```text CONFLUENCE_SINK content_id=attacker-visible-page-id filename=mcp-atlassian-poc-secret.txt CONFLUENCE_EXFIL_MARKER=FAKE_SECRET_MARKER_DO_NOT_PUBLISH_REAL_SECRET CONFLUENCE_RESULT={'success': True, 'filename': 'mcp-atlassian-poc-secret.txt'} JIRA_SINK issue_key=ATTACKER-1 filename=mcp-atlassian-poc-secret.txt JIRA_EXFIL_MARKER=FAKE_SECRET_MARKER_DO_NOT_PUBLISH_REAL_SECRET JIRA_RESULT={'success': True, 'filename': 'mcp-atlassian-poc-secret.txt'} ``` The PoC uses fake upload sinks and does not contact Atlassian. It demonstrates the vulnerable behavior: a caller-provided absolute server-local path is accepted, read, and delivered to the attachment sink. ## Known Issue / Dupe Checks Known advisories are different: - `GHSA-xjgw-4wvw-rgm4`: arbitrary file write through unconstrained Confluence download path. - `GHSA-7r34-79r5-rcc9`: SSRF through unvalidated Atlassian URL headers. Closest public non-security overlap: - issue `#618`: usability report that upload requires server-side paths. - issue `#1163`: unrelated upload failure on Data Center. - PRs `#987` / `#949`: download-path hardening, not upload-source path containment. No public issue/PR/advisory found for upload-side arbitrary local file read. ## Suggested Fix Add an explicit upload source policy, for example: - require `MCP_ATLASSIAN_UPLOAD_BASE_DIR` for server-local upload tools in HTTP/SSE/streamable mode - reject absolute paths unless they resolve inside that configured base directory - apply `validate_safe_path(path, base_dir=upload_base_dir)` before existence checks or reads - consider disabling server-local upload tools by default in HTTP mode unless an upload directory is configured Add regression tests for both Confluence and Jira upload paths: - reject `/etc/passwd` - reject `../../../etc/passwd` - reject symlinks escaping the upload base - accept a file inside the configured upload directory - verify `READ_ONLY_MODE=true` still blocks the write independently
Exploitation Scenario
An attacker plants an indirect prompt injection in a Jira ticket or Confluence page that an organization's AI agent reads. The injected text instructs the agent to call jira_update_issue with attachments set to /app/.env on an issue the attacker can view. The MCP server reads the file and uploads it using the service's Atlassian credentials. The attacker then downloads the attachment, obtains the Atlassian and other API tokens, and uses them to access further data and systems. A malicious authenticated user of a shared HTTP deployment can do the same directly without prompt injection.
Weaknesses (CWE)
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')PrimaryCWE-22Improper Limitation of a Pathname to a Restricted DirectoryCWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-7724410.0MCP Atlassian: unauthenticated access to operator Jira/Confluence
Same package: mcp-atlassianCVE-2026-772549.1MCP Atlassian: missing auth exposes Jira/Confluence
Same package: mcp-atlassianCVE-2026-278259.1mcp-atlassian: Path Traversal enables file access
Same package: mcp-atlassianCVE-2026-772438.8MCP Atlassian: missing authz lets clients call hidden tools
Same package: mcp-atlassianCVE-2026-772628.6mcp-atlassian: path traversal enables arbitrary file read
Same package: mcp-atlassian