CVE-2026-77259: MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluenceuploadattachment opens a caller-selected server-local file without checking that the resolved path remains in the workspace. A caller can upload environment files, credentials, or other readable host data to a Confluence page and retrieve it through Atlassian. The advisory traces the vulnerable input and processing flow through confluenceuploadattachment, filepath, and open(filepath, "rb"), which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MCP Atlassianto a version that resolves this vulnerability.Fixed in 0.22.0
Event History
Frequently Asked Questions
Which deployments are affected?
MCP Atlassian versions before 0.22.0 are affected. The vulnerable functionality is the confluence_upload_attachment entry point.
What access does an attacker need to exploit this issue?
An attacker needs low-level privileges to invoke the affected MCP functionality; no user interaction is required. They can supply a server-local file path that is readable by the MCP Atlassian process.
What data could be exposed?
Readable host files, including environment files and credentials, can be uploaded to a Confluence page and then retrieved through Atlassian. The impact depends on the files accessible to the MCP Atlassian process.
How can I remediate the issue?
Upgrade MCP Atlassian to version 0.22.0 or later. The fix ensures that the resolved file path is checked to remain within the workspace.