CVE-2026-77257: MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths
mcp-atlassian supports HTTP/SSE deployment for persistent, remote, and multi-user use. In that mode, write-capable Jira and Confluence attachment flows accept caller-controlled server-local file paths and read those paths without an upload-source allowlist or base directory restriction.
An authenticated caller, or a prompt-injected agent with tool-call capability, can cause the MCP server process to read a local file it can access and attach that file into a Jira issue or Confluence page using configured Atlassian credentials.
This is distinct from the prior download-path advisory: that issue was an arbitrary file write sink. This path is upload-source local file disclosure.
References
- github.com/advisories/GHSA-mrq8-fv7v-hhjg
- github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460
- github.com/sooperset/mcp-atlassian/pull/1448
- github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0
- github.com/sooperset/mcp-atlassian/security/advisories/GHSA-mrq8-fv7v-hhjg
- nvd.nist.gov/vuln/detail/CVE-2026-77257
Code Behaviors & Features
Detect and mitigate CVE-2026-77257 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →