CVE-2026-77271
Received Received - Intake

Path Traversal in MCP Atlassian Server

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_safe_path defaults its base directory to os.getcwd(), and affected Confluence attachment call sites omit base_dir, allowing attacker-selected writes within the working directory. This Python module overwrite can provide code execution when the application later imports the modified module, bypassing the remediation tracked as CVE-2026-27825. This issue is fixed in version 0.22.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-77271
EUVD
EUVD-2026-84629

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
atlassian confluence to 0.22.0 (exc)
atlassian jira to 0.22.0 (exc)
sooperset mcp-atlassian From 0.17.0 (inc) to 0.21.0 (inc)
sooperset mcp-atlassian 0.22.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77271 is a bypass of a previous path traversal fix in the mcp-atlassian package versions 0.17.0 through 0.21.0. The validate_safe_path() function defaults to the current working directory when no base directory is provided, allowing attackers to overwrite Python module files within the application directory. This can lead to remote code execution if the modified module is imported later.

Detection Guidance

Check if mcp-atlassian versions 0.17.0 through 0.21.0 are installed using pip list or pip show mcp-atlassian. Inspect Confluence attachments for unexpected Python files. Verify MCP HTTP server binding to 0.0.0.0 without authentication using netstat or ss commands.

Impact Analysis

An attacker with Confluence credentials and network access to the MCP HTTP port could upload a malicious Python file as a Confluence attachment. This file could overwrite a module in the application directory, leading to code execution when the application restarts. The MCP HTTP server binds to 0.0.0.0 without authentication by default, increasing exposure.

Compliance Impact

This vulnerability allows attackers to overwrite Python module files within the application directory by exploiting path traversal and code injection. This could lead to unauthorized code execution, potentially exposing sensitive data such as personal or health information. Such breaches may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if exploited in systems handling such data.

Mitigation Strategies

Upgrade mcp-atlassian to version 0.22.0 or later. Configure validate_safe_path() to use a dedicated base directory like MCP_DOWNLOAD_DIR. Restrict Confluence write access and ensure MCP HTTP server binds to localhost only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77271. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart