← Vulnerability feed

Vulnerability record · CVE-2026-77266 · published 22 September 2026

CVE-2026-77266: Mcp-atlassian mcp atlassian path traversal vulnerability

MMcp Atlassian · Mcp Atlassian

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, upload_attachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An MCP caller with attachment access can read a chosen server-local file and exfiltrate it through Jira or Confluence. The advisory traces the vulnerable input and processing flow through upload_attachment, file_path, and path traversal, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

6.5 CVSS 3.1 Medium EPSS 0.48% · top 61.4% CWE-22 · Path traversal
6.5CVSS 3.1 base score
0.48%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References, 2 tagged exploit
28 Sep 2026Last modified by NVD

Description

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, upload_attachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An MCP caller with attachment access can read a chosen server-local file and exfiltrate it through Jira or Confluence. The advisory traces the vulnerable input and processing flow through upload_attachment, file_path, and path traversal, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460 Patch
https://github.com/sooperset/mcp-atlassian/pull/1448 Issue TrackingPatch
https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0 Release Notes
https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-mfv2-4wvm-9pgp ExploitVendor Advisory
https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-mfv2-4wvm-9pgp ExploitVendor Advisory

Track CVE-2026-77266 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2026-77254Mcp-atlassian mcp atlassian missing authentication for critical function vulnerabilityMCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, requests to the HTTP MCP endpoi…EPSS 0.61%8.8CVE-2026-77274Mcp-atlassian mcp atlassian server-side request forgery (ssrf) vulnerabilityMCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf has a bac…EPSS 0.47%8.6CVE-2026-77248Mcp-atlassian mcp atlassian path traversal vulnerabilityMCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the streamable HTTP transport a…EPSS 0.42%8.6CVE-2026-77246Mcp-atlassian mcp atlassian path traversal vulnerabilityMCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, an HTTP transport deployment wi…EPSS 0.22%8.5CVE-2026-77261Mcp-atlassian mcp atlassian server-side request forgery (ssrf) vulnerabilityMCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, _make_ssrf_safe_hook is omitted…EPSS 0.27%8.3CVE-2026-77256Mcp-atlassian mcp atlassian incorrect permission assignment vulnerabilityMCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the plaintext OAuth fallback fi…EPSS 0.41%8.3CVE-2026-77247Mcp-atlassian mcp atlassian vulnerabilityMCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence upload tool…EPSS 0.45%8.3CVE-2026-77271Mcp-atlassian mcp atlassian path traversal vulnerabilityMCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_safe_path defaults its…EPSS 0.42%

Source: NIST National Vulnerability Database (record CVE-2026-77266), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.