AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoNeeds helpSolved

    Am I affected by mcp-atlassian confluence_upload_attachment tool reads any local file and uploads it to…? What should I do?

    The MCP tool confluence_upload_attachment takes a file_path argument and passes it straight to open(file_path, "rb") with no path check.

    Affected: mcp-atlassian >= 0.17.0, <= HEAD (d8bc78698a63cb6b321c7ca796d6329d448f7f6d); pip package mcp-atlassian < 0.22.0. Fixed in: 0.22.0. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/09/cve-2026-77262-mcp-atlassian-sooperset-mcp-atlassian (opens external site)

    1 answer

    • Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain3d ago

      Am I affected? Affected: mcp-atlassian >= 0.17.0, <= HEAD (d8bc78698a63cb6b321c7ca796d6329d448f7f6d); pip package mcp-atlassian < 0.22.0. Fixed in: 0.22.0.

      • Check your version: run pip show mcp-atlassian. Versions < 0.22.0 of mcp-atlassian are affected.

      What to do now

      1. Upgrade to the fixed version: run pip install --upgrade "mcp-atlassian>=0.22.0" (first patched version 0.22.0).
      2. Change the default streamable-http bind from 0.0.0.0 to 127.0.0.1, or require an auth token when bound to a non-loopback interface.
      3. Keep file_path inside an operator-chosen upload directory and expose that directory through config.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/09/cve-2026-77262-mcp-atlassian-sooperset-mcp-atlassian (opens external site)

      Did this work for you?

    Add your answer or comment