CVE-2026-77270

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the Jira and Confluence attachment upload tools treat caller-controlled file_path values as trusted server-local paths. The server opens the selected file and uploads it to an Atlassian issue or page, allowing an MCP caller with upload access to disclose any file readable by the server process. The advisory traces the vulnerable input and processing flow through confluence_upload_attachment, jira_upload_attachment, file_path, and open(file_path, "rb"), which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

• CWE-22

• https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460
• https://github.com/sooperset/mcp-atlassian/pull/1448
• https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0
• https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f26r-j276-ggg4
• https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f26r-j276-ggg4

Published

Sep 22, 2026

Last Modified

Sep 22, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77265MCP Atlassian is a Model Context Protocol (MCP) server for A…5.9
• CVE-2026-77266MCP Atlassian is a Model Context Protocol (MCP) server for A…6.5
• CVE-2026-77267MCP Atlassian is a Model Context Protocol (MCP) server for A…8.3
• CVE-2026-77268MCP Atlassian is a Model Context Protocol (MCP) server for A…5.5
• CVE-2026-77269MCP Atlassian is a Model Context Protocol (MCP) server for A…6.5
• CVE-2026-7727A vulnerability was determined in Shandong Hoteam Software P…7.3
• CVE-2026-77271MCP Atlassian is a Model Context Protocol (MCP) server for A…8.3
• CVE-2026-77272MCP Atlassian is a Model Context Protocol (MCP) server for A…5.4
• CVE-2026-77274MCP Atlassian is a Model Context Protocol (MCP) server for A…8.8
• CVE-2026-7728A vulnerability was identified in ryanjoachim mcp-rtfm 0.1.0…6.3
• CVE-2026-77281Caddy is an extensible server platform that uses TLS by defa…6.5
• CVE-2026-7729A security flaw has been discovered in pixelsock directus-mc…6.3