Tracking: CVE-2026-77258
Severity: High
Who is affected
mcp-atlassian before 0.22.0. A caller must reach the Confluence attachment-upload operation, directly through MCP or through an agent induced to use it.
How the attack works
upload_attachment opens a caller-supplied local path without invoking the validate_safe_path check used by download operations. A file outside MCP_ALLOWED_LOCAL_DIR can therefore be read and uploaded to Confluence.
The exposed data is limited by the MCP process's read permissions. That can still include environment files, cloud credentials, SSH material, or application configuration mounted into the server. Existing path restrictions are not reliable protection for this vulnerable upload path.
What to do
- Upgrade to 0.22.0 or later and restart every affected MCP instance.
- Review Confluence uploads and MCP tool logs for files unrelated to the intended project. Check what local directories the server could read.
- Remove unauthorized attachments and revoke exposed credentials if evidence shows that sensitive files were uploaded.
Scope and limits
Several CVEs in this collection describe overlapping Atlassian upload weaknesses. They are separate published reports, not proof of six independent compromise events.