Read the docs
TI-2026-53931 Aliases CVE-2026-77247GHSA-f6pj-qv47-g96w

MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

Priority HIGH 69CWE-73Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-73 and the CVSS impact.

Summary

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence upload tools interpret caller-controlled path arguments on the MCP server and open those files before sending them as attachments. In remote or multi-user deployments, a permitted client can disclose host files without shell or direct filesystem access. The advisory traces the vulnerable input and processing flow through AttachmentsMixin.upload_attachment, AttachmentsMixin.upload_attachments, file_path, file_paths, and jira update_issue, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00388 33rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed mcp-atlassian (sooperset): 0.22.0mcp-atlassian (PyPI): 0.22.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
soopersetmcp-atlassianbefore 0.22.00.22.0Patch availableCNA
—mcp-atlassian (PyPI)before 0.22.00.22.0Patch availableGHSA-f6pj-qv47-g96w
  • mcp-atlassian Vendorsooperset Affected before 0.22.0 Fixed in 0.22.0 Patch available CNA
  • mcp-atlassian (PyPI) Vendor— Affected before 0.22.0 Fixed in 0.22.0 Patch available GHSA-f6pj-qv47-g96w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mcp-atlassian:mcp_atlassian:*:*:*:*:*:*:*:*before 0.22.0VulnerableMcp-atlassian
  • cpe:2.3:a:mcp-atlassian:mcp_atlassian:*:*:*:*:*:*:*:* Versions before 0.22.0 Vulnerable ·Mcp-atlassian

Remediation

  • Fix · CNA mcp-atlassian (sooperset) Fixed in 0.22.0
  • Fix · GHSA-f6pj-qv47-g96w mcp-atlassian (PyPI) Fixed in 0.22.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77247
  2. 2026-10-03 Alias added: GHSA-f6pj-qv47-g96w

References

Exploit 1

Patch 2

Other 2

  • TI-2026-53938 MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials CVSS 3.1CRITICAL 9.1
  • TI-2026-53957 MCP Atlassian: SSRF Protection Bypass CVSS 4.0HIGH 8.8
  • TI-2026-53935 Protection mechanism failure in sooperset mcp-atlassian CVSS 4.0HIGH 8.3
  • TI-2026-53946 Path traversal in sooperset mcp-atlassian CVSS 3.1HIGH 8.6
  • TI-2026-53932 Path traversal in sooperset mcp-atlassian CVSS 3.1HIGH 8.6
  • TI-2026-22177 Path traversal in sooperset mcp-atlassian CVSS 3.1CRITICAL 9.1
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences