CVE-2026-77271: MCP Atlassian: path traversal enables code execution

Q: Is CVE-2026-77271 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-77271, increasing the risk of exploitation.

Q: How to fix CVE-2026-77271?

1) Upgrade mcp-atlassian to 0.22.0 or later (pip install -U mcp-atlassian) and confirm the version in every environment, including developer machines and containers. 2) Until patched, disable or restrict attachment download tools, for example by limiting the exposed tool set or running the server in read-only mode. 3) Run the MCP server as an unprivileged user in a container, with a read-only code directory and a dedicated writable scratch directory, so Python modules cannot be overwritten. 4) Rotate Atlassian API tokens on any host that ran a vulnerable version with attachment tools enabled. 5) Detect: monitor for file writes to .py files or __pycache__ in the server's working directory, unexpected child processes from the MCP server, and attachment filenames containing '../' or absolute paths. 6) Review Confluence for untrusted attachments from external or low-trust authors.

Q: What systems are affected by CVE-2026-77271?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling LLM agents, enterprise knowledge integrations.

Q: What is the CVSS score for CVE-2026-77271?

No CVSS score has been assigned yet.

GHSA-6vmq-24h2-pj7jHIGHPoC AVAILABLECISA: TRACK*

Published September 22, 2026

CISO Take

MCP Atlassian, the MCP server that lets AI agents work with Confluence and Jira, has a path traversal flaw (CWE-22) in its attachment handling that lets an attacker write files anywhere under the server's working directory. Overwriting a Python module there leads to code execution the next time the application imports it (CWE-94). This bypasses the earlier fix for CVE-2026-27825, so organizations that considered that issue closed are exposed again. Exploitation risk today is moderate: EPSS is 0.0053 (top 57%), there is no public exploit or Nuclei template, and the CVE is not in CISA KEV, but CISA SSVC rates it TRACK*, meaning it should be watched closely. Only 1 downstream dependent is recorded, but the package has had 38 other CVEs, which points to a recurring weakness in its security hygiene. Upgrade mcp-atlassian to 0.22.0 or later and review any agent that is allowed to download Confluence attachments.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

High severity, moderate near-term exploitation likelihood. The CVSS score is not published, but the description implies a network-reachable file write that leads to code execution. Exploitation needs the ability to influence attachment names or paths. That can come from a malicious Confluence page or attachment, or from a prompt-injected agent. There is no public exploit or KEV listing. This is a regression bypass of CVE-2026-27825, so attackers already know the weakness class. The package's history of 38 CVEs raises the chance of further bypasses. The package risk score is 45/100. Confidence: MEDIUM, because there is no CVSS vector and the exact trigger conditions are not stated.

How does the attack unfold?

Initial Access

Attacker plants a crafted attachment on Confluence or steers the agent toward it via content it reads.

AML.T0051.001

Tool Invocation

The agent calls the Confluence attachment download tool, which resolves the path against the working directory with no base_dir restriction.

AML.T0053

Code Execution

A Python module is overwritten and the attacker's code runs when the application next imports it.

AML.T0050

Impact

Atlassian tokens and data are stolen, and the attacker gains persistence on the agent host.

AML.T0112.000

Initial Access

Attacker plants a crafted attachment on Confluence or steers the agent toward it via content it reads.

AML.T0051.001

Tool Invocation

The agent calls the Confluence attachment download tool, which resolves the path against the working directory with no base_dir restriction.

AML.T0053

Code Execution

A Python module is overwritten and the attacker's code runs when the application next imports it.

AML.T0050

Impact

Atlassian tokens and data are stolen, and the attacker gains persistence on the agent host.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MCP Atlassian	pip	< 0.22.0	`0.22.0`
2 dependents85% patched~4d to patchFull package profile →

Do you use MCP Atlassian? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.6%

chance of exploitation in 30 days

Higher than 49% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

1) Upgrade mcp-atlassian to 0.22.0 or later (pip install -U mcp-atlassian) and confirm the version in every environment, including developer machines and containers. 2) Until patched, disable or restrict attachment download tools, for example by limiting the exposed tool set or running the server in read-only mode. 3) Run the MCP server as an unprivileged user in a container, with a read-only code directory and a dedicated writable scratch directory, so Python modules cannot be overwritten. 4) Rotate Atlassian API tokens on any host that ran a vulnerable version with attachment tools enabled. 5) Detect: monitor for file writes to .py files or __pycache__ in the server's working directory, unexpected child processes from the MCP server, and attachment filenames containing '../' or absolute paths. 6) Review Confluence for untrusted attachments from external or low-trust authors.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSupply ChainAgentPluginFrameworkAML.T0050- Command and Scripting Interpreter AML.T0051.001- Indirect AML.T0053- AI Agent Tool Invocation AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Responses to identified risks and unknown risks

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-77271?

Is CVE-2026-77271 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-77271, increasing the risk of exploitation.

How to fix CVE-2026-77271?

1) Upgrade mcp-atlassian to 0.22.0 or later (pip install -U mcp-atlassian) and confirm the version in every environment, including developer machines and containers. 2) Until patched, disable or restrict attachment download tools, for example by limiting the exposed tool set or running the server in read-only mode. 3) Run the MCP server as an unprivileged user in a container, with a read-only code directory and a dedicated writable scratch directory, so Python modules cannot be overwritten. 4) Rotate Atlassian API tokens on any host that ran a vulnerable version with attachment tools enabled. 5) Detect: monitor for file writes to .py files or __pycache__ in the server's working directory, unexpected child processes from the MCP server, and attachment filenames containing '../' or absolute paths. 6) Review Confluence for untrusted attachments from external or low-trust authors.

What systems are affected by CVE-2026-77271?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling LLM agents, enterprise knowledge integrations.

What is the CVSS score for CVE-2026-77271?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP serverstool-calling LLM agentsenterprise knowledge integrations

MITRE ATLAS Techniques

AML.T0050Command and Scripting Interpreter

AML.T0051.001Indirect

AML.T0053AI Agent Tool Invocation

AML.T0112.000Local AI Agent

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_safe_path defaults its base directory to os.getcwd(), and affected Confluence attachment call sites omit base_dir, allowing attacker-selected writes within the working directory. This Python module overwrite can provide code execution when the application later imports the modified module, bypassing the remediation tracked as CVE-2026-27825. This issue is fixed in version 0.22.0.

Exploitation Scenario

An attacker with the ability to edit or attach to a Confluence page, or a low-privileged insider or external collaborator, uploads an attachment with a crafted name that resolves to a Python module in the MCP server's working directory. An AI agent, asked to fetch or summarize that page's attachments, calls the vulnerable download tool, and the server writes attacker-controlled content over the module. On the next import or server restart, the malicious code runs with the server's privileges. It exfiltrates Atlassian tokens and environment secrets, and can establish persistence. The same chain can be started through indirect prompt injection that steers the agent to download the attachment.

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Primary CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-22Improper Limitation of a Pathname to a Restricted Directory CWE-94Improper Control of Generation of Code

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.