MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths
- Product
- mcp-atlassian
- CVE
- CVE-2026-77257
- Affected
- mcp-atlassian < 0.22.0
- Fixed in
- 0.22.0
Last verified against sources: October 26, 2026
Am I affected?
mcp-atlassian: affected mcp-atlassian < 0.22.0. Fixed in 0.22.0.
- Check your version: run
pip show mcp-atlassian. Versions < 0.22.0 of mcp-atlassian are affected. [1]
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "mcp-atlassian>=0.22.0"(first patched version 0.22.0). [1] - Set READ_ONLY_MODE=true to block write tools; the project documents it as an optional hardening setting that is off by default. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- In HTTP mode, the Jira and Confluence attachment upload tools accept file paths chosen by the caller. [1]
- The server reads that file from its own filesystem and attaches it to a Jira issue or Confluence page using the configured Atlassian credentials. [1]
- There is no check that the file sits inside an allowed upload folder, so the caller can point at any file the server process can read. [1]
Impact
- An attacker who can call the upload tools can read local files the server process can access and attach them to a Jira issue or Confluence page. [1]
- In Docker or Kubernetes setups that mount a .env file or token material, the files exposed may include API tokens, OAuth credentials, service configuration, or other local secrets. [1]
- The attacker needs a call path to a write tool and a Jira issue or Confluence page where the attachment can be written. [1]
- This is not direct remote code execution. [1]
What was done
Sources
- GHSA-mrq8-fv7v-hhjg — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-77257] MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths
Product: mcp-atlassian | Affected: mcp-atlassian < 0.22.0 | Fixed in: 0.22.0
Summary: In HTTP mode, the Jira and Confluence attachment upload tools accept file paths chosen by the caller.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/09/cve-2026-77257-mcp-atlassianCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-77257
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.