CVE-2026-77260: MCP Atlassian: path traversal in upload_attachment

Q: Is CVE-2026-77260 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-77260, increasing the risk of exploitation.

Q: How to fix CVE-2026-77260?

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448, commit b041733). 2) Until patched, disable or block the upload_attachment tools in the MCP client tool allowlist, or run the server in read-only mode if supported. 3) Run the MCP server in a container or sandbox with a minimal filesystem, no home directory mounts, and no secrets in its environment. 4) Use least-privilege Atlassian tokens scoped to required projects. 5) Detection: audit Jira and Confluence for unexpected attachments (especially .env, id_rsa, config files, credentials), and review MCP server and agent logs for upload_attachment calls with absolute paths or ../ sequences. 6) Rotate any credentials that may have been exposed.

Q: What systems are affected by CVE-2026-77260?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling LLM agents, developer AI assistants.

Q: What is the CVSS score for CVE-2026-77260?

No CVSS score has been assigned yet.

GHSA-f4p7-qx46-wc5jHIGHPoC AVAILABLECISA: ATTEND

Published September 22, 2026

CISO Take

MCP Atlassian, the MCP server that connects AI agents to Jira and Confluence, accepts an unrestricted file_path in its upload_attachment tools, so any permitted MCP caller can make the server read arbitrary local files and push them into an Atlassian page or issue, where they can then be retrieved. This is a high-severity path traversal (CWE-22) with a public PoC and a CISA SSVC decision of ATTEND. EPSS is low in absolute terms (0.00349) but sits in the top 74% percentile. It is not in CISA KEV and no Nuclei template exists. The package has only 1 tracked downstream dependent but 38 other CVEs, which signals a weak security track record. The practical risk is amplified because a prompt-injected agent can trigger the tool call without a human attacker holding direct credentials. Upgrade mcp-atlassian to 0.22.0 or later, and review which agents and users hold Atlassian write access through MCP.

Sources:NVDGitHub AdvisoryEPSSATLASgithub.com/sooperset/mcp-atlassian

What is the risk?

High. Exploitation is low complexity: the attacker only needs the ability to invoke upload_attachment, directly or by steering an LLM agent through prompt injection. A public PoC exists and SSVC says ATTEND. EPSS is low (0.00349, ~74th percentile) and there is no KEV listing or scanner template, so mass exploitation is not currently observed. Impact is mainly confidentiality: any file readable by the MCP server process (SSH keys, .env files, cloud credentials, tokens) can be exfiltrated. Exposure is highest where the MCP server runs on developer workstations or shared agent hosts with sensitive files and broad filesystem access.

How does the attack unfold?

Initial Access

Attacker gains MCP caller access or injects instructions into content an AI agent processes.

AML.T0051.001

Tool Invocation

The agent calls upload_attachment with a sensitive absolute or traversal file_path.

AML.T0053

Collection

The MCP server reads the arbitrary local file with its own OS privileges.

AML.T0037

Exfiltration

The file is uploaded to Jira or Confluence and retrieved by the attacker.

AML.T0086

Initial Access

Attacker gains MCP caller access or injects instructions into content an AI agent processes.

AML.T0051.001

Tool Invocation

The agent calls upload_attachment with a sensitive absolute or traversal file_path.

AML.T0053

Collection

The MCP server reads the arbitrary local file with its own OS privileges.

AML.T0037

Exfiltration

The file is uploaded to Jira or Confluence and retrieved by the attacker.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MCP Atlassian	pip	< 0.22.0	`0.22.0`
2 dependents85% patched~4d to patchFull package profile →

Do you use MCP Atlassian? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.4%

chance of exploitation in 30 days

Higher than 33% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448, commit b041733). 2) Until patched, disable or block the upload_attachment tools in the MCP client tool allowlist, or run the server in read-only mode if supported. 3) Run the MCP server in a container or sandbox with a minimal filesystem, no home directory mounts, and no secrets in its environment. 4) Use least-privilege Atlassian tokens scoped to required projects. 5) Detection: audit Jira and Confluence for unexpected attachments (especially .env, id_rsa, config files, credentials), and review MCP server and agent logs for upload_attachment calls with absolute paths or ../ sequences. 6) Rotate any credentials that may have been exposed.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data ExtractionData LeakageAgentPluginAML.T0037- Data from Local System AML.T0053- AI Agent Tool Invocation AML.T0055- Unsecured Credentials AML.T0085.001- AI Agent Tools AML.T0086- Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to unknown or emergent risks

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM05-Supply Chain VulnerabilitiesLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-77260?

Is CVE-2026-77260 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-77260, increasing the risk of exploitation.

How to fix CVE-2026-77260?

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448, commit b041733). 2) Until patched, disable or block the upload_attachment tools in the MCP client tool allowlist, or run the server in read-only mode if supported. 3) Run the MCP server in a container or sandbox with a minimal filesystem, no home directory mounts, and no secrets in its environment. 4) Use least-privilege Atlassian tokens scoped to required projects. 5) Detection: audit Jira and Confluence for unexpected attachments (especially .env, id_rsa, config files, credentials), and review MCP server and agent logs for upload_attachment calls with absolute paths or ../ sequences. 6) Rotate any credentials that may have been exposed.

What systems are affected by CVE-2026-77260?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling LLM agents, developer AI assistants.

What is the CVSS score for CVE-2026-77260?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP serverstool-calling LLM agentsdeveloper AI assistants

MITRE ATLAS Techniques

AML.T0037Data from Local System

AML.T0053AI Agent Tool Invocation

AML.T0055Unsecured Credentials

AML.T0085.001AI Agent Tools

AML.T0086Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM05, LLM06

What are the technical details?

Original Advisory

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the Confluence and Jira upload_attachment implementations accept an unconstrained file_path and open the referenced server-local file. A permitted MCP caller can upload sensitive host files to an Atlassian destination and then retrieve their contents. The advisory traces the vulnerable input and processing flow through upload_attachment, file_path, and CVE-2026-27825, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Exploitation Scenario

An attacker plants a malicious instruction in a Jira ticket comment or Confluence page that an engineering AI assistant later reads. The injected prompt tells the agent to call upload_attachment with file_path set to ~/.aws/credentials or the server's .env file, attaching it to a ticket the attacker can view. The vulnerable MCP server opens the local file and uploads it without validating the path. The attacker then downloads the attachment from Atlassian, obtains cloud credentials, and pivots into the organization's infrastructure. A malicious or compromised MCP user with direct tool access can perform the same steps without prompt injection.

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Primary CWE-22Improper Limitation of a Pathname to a Restricted Directory

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.