Arbitrary File Read Vulnerability in MCP Atlassian for Jira and Confluence

CVE-2026-77255

What is CVE-2026-77255?

MCP Atlassian, a server designed for use with Jira and Confluence, exhibited a vulnerability prior to version 0.22.0. The issue arose from the Jira update_issue's attachment argument being processed without proper workspace validation, allowing an attacker to exploit the MCP server. By providing local paths, an attacker could read arbitrary files and potentially exfiltrate sensitive data by attaching them to a Jira issue. This flaw predominantly affects users by misrouting file access requests, which can lead to unauthorized file disclosures. The vulnerability was addressed in version 0.22.0, ensuring enhanced security measures are in place.

References