CVE-2026-77248: MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while uploadattachment accepts an unrestricted filepath. An unauthenticated network caller can read files available to the MCP process, upload them to an attacker-selected Jira issue or Confluence page, and retrieve the contents. The advisory traces the vulnerable input and processing flow through streamable-http, UserTokenMiddleware, uploadattachment, filepath, and getfetcher, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MCP Atlassianto a version that resolves this vulnerability.Fixed in 0.22.0
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Deployments running MCP Atlassian before 0.22.0 that expose the streamable HTTP transport to network callers are exposed. The attacker does not need an authenticated user identity because the affected transport falls back to operator credentials.
What does an attacker need to exploit this issue?
An attacker needs network access to the affected streamable HTTP transport. They can supply a file_path to upload_attachment and select a Jira issue or Confluence page to receive the uploaded file.
What data can be accessed?
The attacker can read files that are available to the MCP process. The file contents can be uploaded as an attachment and then retrieved from the selected Jira issue or Confluence page.
What should be done to remediate the issue?
Upgrade MCP Atlassian to version 0.22.0, which fixes the issue. The vulnerable behavior affects versions prior to 0.22.0.