CVE-2026-77248
Received Received - Intake

MCP Atlassian Unauthenticated File Read and Upload Vulnerability

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while upload_attachment accepts an unrestricted file_path. An unauthenticated network caller can read files available to the MCP process, upload them to an attacker-selected Jira issue or Confluence page, and retrieve the contents. The advisory traces the vulnerable input and processing flow through streamable-http, UserTokenMiddleware, upload_attachment, file_path, and _get_fetcher, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-77248
EUVD
EUVD-2026-84763

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
atlassian mcp-atlassian to 0.22.0 (exc)
atlassian mcp to 0.22.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77248 is a high-severity vulnerability in MCP Atlassian versions before 0.22.0. It allows unauthenticated attackers to read arbitrary files on the server and upload them to Jira or Confluence. The flaw stems from missing authentication in the streamable-http transport and improper file path validation in the upload_attachment tool.

Detection Guidance

Check if your mcp-atlassian version is below 0.22.0 by running: pip show mcp-atlassian. If installed, verify if the streamable-http transport is bound to 0.0.0.0 without authentication. Inspect network logs for unauthenticated requests to /upload_attachment with arbitrary file_path parameters.

Impact Analysis

An attacker could exploit this to read sensitive files like API tokens, SSH keys, or system files. They could also upload malicious files to Jira issues or Confluence pages, potentially leading to further compromise of the system or data exfiltration.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. It may result in data breaches, non-compliance penalties, and loss of trust.

Mitigation Strategies

Upgrade mcp-atlassian to version 0.22.0 or later immediately. Ensure authentication is enforced on the streamable-http transport and implement strict path validation for the upload_attachment tool to prevent arbitrary file access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77248. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart