Tracking: CVE-2026-77255
Severity: High
Who is affected
mcp-atlassian before 0.22.0, when an MCP caller can use Jira update_issue with attachments and the service account can read the selected file.
How the attack works
The attachments parameter accepts a local path without enforcing the configured filesystem boundary. The server then reads that path using its own permissions and uploads it to Jira.
This is a confused-deputy problem: a caller uses the MCP server's greater filesystem access to perform an otherwise legitimate upload. A prompt-injected agent may provide the input, but direct tool access is enough when the caller already controls the parameter.
What to do
- Upgrade to 0.22.0 or later and restart affected servers.
- Review issue updates that added attachments, especially from automated agents. Look for environment files, keys, configuration, or other material unrelated to the issue.
- Limit the server's readable directories. Revoke exposed secrets and remove unauthorized attachments after preserving incident evidence.
Scope and limits
The published GitHub advisory rates this issue High. It overlaps other mcp-atlassian attachment-upload reports in this collection.