CVE-2026-77270: MCP Atlassian: path traversal in attachment upload leaks files

Q: Is CVE-2026-77270 actively exploited?

No confirmed active exploitation of CVE-2026-77270 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-77270?

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448, commit b041733). 2) Until patched, disable or block the jira_upload_attachment and confluence_upload_attachment tools through MCP client tool allowlists or a gateway. 3) Run the MCP server as a dedicated low-privilege user or in a container with a minimal filesystem and no mounted secrets or home directory. 4) Require human approval for tool calls that handle files. 5) Detection: audit tool-call logs for file_path values pointing outside expected directories (absolute paths, ../ sequences, /etc, ~/.ssh, .env), and review recent Jira/Confluence attachments for unexpected configuration or key files. 6) Rotate any credentials that may have been exposed on hosts where the server ran unpatched.

Q: What systems are affected by CVE-2026-77270?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, MCP servers, Tool-calling LLM assistants, Developer productivity AI workflows.

Q: What is the CVSS score for CVE-2026-77270?

CVE-2026-77270 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.50%.

GHSA-f26r-j276-ggg4MEDIUMCISA: TRACK*

Published September 22, 2026

CISO Take

MCP Atlassian, an MCP server that lets AI agents work with Jira and Confluence, trusts caller-supplied file_path values in its attachment upload tools. Any caller with upload access can therefore make the server read any file its process can access and upload it to an Atlassian issue or page, which is an arbitrary file disclosure. In an agent setting, a prompt-injected or malicious caller can trigger this without a human noticing, and a stolen file (SSH keys, .env files, cloud credentials) can be exfiltrated through a trusted SaaS channel. Exploitation likelihood is low for now: EPSS is 0.00374 (71st percentile), there is no public exploit or Nuclei template, it is not in CISA KEV, and the SSVC decision is TRACK*. Blast radius is limited (1 downstream dependent), but the package has 38 other CVEs, which points to a weak security track record. Upgrade mcp-atlassian to 0.22.0 or later, and run the server with a least-privilege account and a restricted filesystem view until you do.

Sources:NVDEPSSGitHub AdvisoryATLASCISA SSVC

What is the risk?

Medium (CVSS 6.5). The attack is network-reachable, low complexity, needs low privileges and no user interaction, and the impact is a high loss of confidentiality only (no integrity or availability impact). Exploitation probability is low (EPSS 0.00374, no public exploit, not in KEV, SSVC TRACK*). Real-world risk rises sharply when the server runs with broad filesystem access, such as on a developer workstation or in a container with mounted secrets, and when an LLM agent can be steered by untrusted content (Jira tickets, Confluence pages) into calling the upload tools. Credentials stolen this way could enable follow-on compromise.

How does the attack unfold?

Initial Access

The attacker gains upload access to the MCP server, or plants a prompt injection in Jira or Confluence content that the agent processes.

AML.T0051.001

Tool Invocation

The agent calls jira_upload_attachment or confluence_upload_attachment with an attacker-chosen file_path such as ~/.ssh/id_rsa.

AML.T0053

Local File Read

The server opens the path with open(file_path, "rb") without validation and reads any file readable by its process.

AML.T0037

Exfiltration

The file is uploaded to an Atlassian issue or page the attacker can read, disclosing credentials or sensitive data.

AML.T0086

Initial Access

The attacker gains upload access to the MCP server, or plants a prompt injection in Jira or Confluence content that the agent processes.

AML.T0051.001

Tool Invocation

The agent calls jira_upload_attachment or confluence_upload_attachment with an attacker-chosen file_path such as ~/.ssh/id_rsa.

AML.T0053

Local File Read

The server opens the path with open(file_path, "rb") without validation and reads any file readable by its process.

AML.T0037

Exfiltration

The file is uploaded to an Atlassian issue or page the attacker can read, disclosing credentials or sensitive data.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MCP Atlassian	pip	< 0.22.0	`0.22.0`
2 dependents85% patched~4d to patchFull package profile →

Do you use MCP Atlassian? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 43% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448, commit b041733). 2) Until patched, disable or block the jira_upload_attachment and confluence_upload_attachment tools through MCP client tool allowlists or a gateway. 3) Run the MCP server as a dedicated low-privilege user or in a container with a minimal filesystem and no mounted secrets or home directory. 4) Require human approval for tool calls that handle files. 5) Detection: audit tool-call logs for file_path values pointing outside expected directories (absolute paths, ../ sequences, /etc, ~/.ssh, .env), and review recent Jira/Confluence attachments for unexpected configuration or key files. 6) Rotate any credentials that may have been exposed on hosts where the server ran unpatched.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data ExtractionData LeakagePrompt InjectionAgentPluginFrameworkAML.T0037- Data from Local System AML.T0051.001- Indirect AML.T0053- AI Agent Tool Invocation AML.T0085.001- AI Agent Tools AML.T0086- Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and mechanisms to supersede or deactivate systems

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-77270?

Is CVE-2026-77270 actively exploited?

No confirmed active exploitation of CVE-2026-77270 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-77270?

1) Upgrade mcp-atlassian to 0.22.0 or later (fix in PR #1448, commit b041733). 2) Until patched, disable or block the jira_upload_attachment and confluence_upload_attachment tools through MCP client tool allowlists or a gateway. 3) Run the MCP server as a dedicated low-privilege user or in a container with a minimal filesystem and no mounted secrets or home directory. 4) Require human approval for tool calls that handle files. 5) Detection: audit tool-call logs for file_path values pointing outside expected directories (absolute paths, ../ sequences, /etc, ~/.ssh, .env), and review recent Jira/Confluence attachments for unexpected configuration or key files. 6) Rotate any credentials that may have been exposed on hosts where the server ran unpatched.

What systems are affected by CVE-2026-77270?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, MCP servers, Tool-calling LLM assistants, Developer productivity AI workflows.

What is the CVSS score for CVE-2026-77270?

CVE-2026-77270 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.50%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksMCP serversTool-calling LLM assistantsDeveloper productivity AI workflows

MITRE ATLAS Techniques

AML.T0037Data from Local System

AML.T0051.001Indirect

AML.T0053AI Agent Tool Invocation

AML.T0085.001AI Agent Tools

AML.T0086Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the Jira and Confluence attachment upload tools treat caller-controlled file_path values as trusted server-local paths. The server opens the selected file and uploads it to an Atlassian issue or page, allowing an MCP caller with upload access to disclose any file readable by the server process. The advisory traces the vulnerable input and processing flow through confluence_upload_attachment, jira_upload_attachment, file_path, and open(file_path, "rb"), which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Exploitation Scenario

An attacker plants a prompt injection in a Jira ticket comment or Confluence page that an engineering team's AI assistant processes. The injected instructions tell the agent to call jira_upload_attachment with file_path set to a sensitive local file, for example ~/.ssh/id_rsa or the project's .env, targeting an issue the attacker can view. The MCP server opens the file and uploads it without validating the path. The attacker then downloads the attachment from the issue and uses the stolen credentials to reach source repositories or cloud environments. A direct attacker with low-privilege access to the MCP endpoint can do the same without prompt injection.

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Primary CWE-22Improper Limitation of a Pathname to a Restricted Directory

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.