CVE-2026-77257: MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths
mcp-atlassian supports HTTP/SSE deployment for persistent, remote, and multi-user use. In that mode, write-capable Jira and Confluence attachment flows accept caller-controlled server-local file paths and read those paths without an upload-source allowlist or base directory restriction.
An authenticated caller, or a prompt-injected agent with tool-call capability, can cause the MCP server process to read a local file it can access and attach that file into a Jira issue or Confluence page using configured Atlassian credentials.
This is distinct from the prior download-path advisory: that issue was an arbitrary file write sink. This path is upload-source local file disclosure.
References
- github.com/advisories/GHSA-mrq8-fv7v-hhjg
- github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460
- github.com/sooperset/mcp-atlassian/pull/1448
- github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0
- github.com/sooperset/mcp-atlassian/security/advisories/GHSA-mrq8-fv7v-hhjg
- nvd.nist.gov/vuln/detail/CVE-2026-77257
Code Behaviors & Features
Detect and mitigate CVE-2026-77257 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →